Casablanca MSB Security/Vulnerability Report
- Michael O'Brien
- Amy Zwarico
This table represents the known exploitable and non-exploitable vulnerabilities in third party packages used in the project.
Repository | Group | Impact Analysis | Action |
|---|---|---|---|
msb-apigateway | com.fasterxml.jackson.core | False Positive Explaination: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. msb-apigateway doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on msb-apigateway. https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization msb-apigateway codes using ObjectMapper: | Raised a ticket to LF:https://rt.linuxfoundation.org/SelfService/Display.html?id=53375 |
msb-apigateway | org.springframework | This vulnerability issue is an indirect dependency introduced by msb-swagger-sdk, which is a false positive. msb-apigateway doesn't use Common-collection lib in its codes. | |
msb-apigateway | commons-collections | This vulnerability issue is an indirect dependency introduced by msb-swagger-sdk, which is a false positive. msb-apigateway doesn't use Common-collection lib in its codes. | Raised a ticket to LF:https://rt.linuxfoundation.org/SelfService/Display.html?id=53375 |
msb-apigateway | commons-beanutils | This vulnerability issue is an indirect dependency introduced by msb-swagger-sdk, which is a false positive. msb-apigateway doesn't use Common-collection lib in its codes. | Raised a ticket to LF:https://rt.linuxfoundation.org/SelfService/Display.html?id=53375 |
msb-apigateway | org.webjars bootstrap | The bug has been fixed in upstream project, but not included in its latest release yet, it will be updated once the upstream project release the new version. | |
msb-apigateway | org.webjars bootstrap | The bug has been fixed in upstream project, but not included in its latest release yet, it will be updated once the upstream project release the new version. | |
msb-apigateway | org.webjars bootstrap | The bug has been fixed in upstream project, but not included in its latest release yet, it will be updated once the upstream project release the new version. | |
msb-discovery | com.fasterxml.jackson.core | False Positive Explanation: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. msb-discovery doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on msb-discovery. https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization msb-discovery codes using ObjectMapper: | Raised a ticket to LF:https://rt.linuxfoundation.org/SelfService/Display.html?id=53375 |
msb-discovery | com.smoketurner.dropwizard | It's an example brought by indirect dependency. Because the codes are not called by MSB, so it has no impact to MSB and it's downstream project. However, it should and will be deleted from MSB dependencies in the next release. | |
msb-java-sdk | com.fasterxml.jackson.core | False Positive Explanation: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. msb-discovery doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on msb-discovery. https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization msb-java-sdk codes using ObjectMapper: | Raised a ticket to LF:https://rt.linuxfoundation.org/SelfService/Display.html?id=53375 |
msb-java-sdk | com.fasterxml.jackson.core | False Positive Explanation: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization. msb-discovery doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on msb-discovery. https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization msb-java-sdk codes using ObjectMapper: | |
msb-swagger-sdk | com.fasterxml.jackson.core | False Positive It does not cause any issues to the services and service does not expose functionality directly | LF already waived it |
msb-swagger-sdk | com.fasterxml.jackson.core | False Positive It does not cause any issues to the services and service does not expose functionality directly | LF already waived it |
msb-swagger-sdk | com.fasterxml.jackson.dataformat | False Positive It does not cause any issues to the services and service does not expose functionality directly | LF already waived it |
msb-swagger-sdk | commons-beanutils | False Positive It does not cause any issues to the services and service does not expose functionality directly | LF already waived it |
msb-swagger-sdk | commons-collections | False Positive It does not cause any issues to the services and service does not expose functionality directly | LF already waived it |