Cleaning submodules and rename engineering package #72
Conversation
![sonatype-lift[bot]](https://avatars.githubusercontent.com/in/9843?s=60&v=4){kind=small}
| @@ -267,13 +267,13 @@ POSSIBILITY OF SUCH DAMAGE. | |||
|
|
|||
| <dependency> | |||
| <groupId>gov.nasa.pds</groupId> | |||
| <artifactId>api</artifactId> | |||
| <artifactId>registry-api-model</artifactId> | |||
| <version>0.5.0-SNAPSHOT</version> | |||
| </dependency> | |||
|
|
|||
| <dependency> | |||
There was a problem hiding this comment.
Critical OSS Vulnerability:
pkg:maven/gov.nasa.pds/[email protected]
4 Critical, 0 Severe, 2 Moderate, 0 Unknown vulnerabilities have been found across 2 dependencies
Components
- The configuration file specifies an allowed third-party
JNDIlookup host for theJMSAppender - the
javax.jms.*API is included in the application'sCLASSPATH - Restrict LDAP access via JNDI apache/logging-log4j2#608 (comment)
- https://logging.apache.org/log4j/1.2/
- The configuration file specifies an allowed third-party
JNDIlookup host for theJMSAppender - the
javax.jms.*API is included in the application'sCLASSPATH - Restrict LDAP access via JNDI apache/logging-log4j2#608 (comment)
- https://logging.apache.org/log4j/1.2/
pkg:maven/log4j/[email protected]
CRITICAL Vulnerabilities (2)
CVE-2019-17571
[CVE-2019-17571] Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserializat...
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
CVSS Score: 9.8
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2021-4104
[CVE-2021-4104] JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when...
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
===================================================
The following information is provided by Sonatype Nexus Intelligence. Nexus Intelligence is the only security research service that performs "secondary expansion" to determine if newly discovered vulnerabilities are also present in other components.
Learn more about Nexus Intelligence -- https://www.sonatype.com/products/intelligence
Explanation
The log4j:log4j package is vulnerable to Deserialization of Untrusted Data. The lookup() and activateOptions() methods in the JMSAppender class allow JNDI lookup requests to be made when the TopicBindingName and TopicConnectionFactoryBindingName specify a trusted host. Lookups made to this host may be used by attackers to request a serialized malicious Java Object that can be deserialized and executed, leading to Remote Code Execution (RCE).
Note that this vulnerability is different from CVE-2021-44228 and requires the attacker to be in control of the third party host that is specified in the configuration, or write access to the Log4j configuration file in order to specify a malicious lookup host directly. This vulnerability also only affects the 1.x.x component of Log4j released under the log4j:log4j group and artifact IDs.
Advisory Deviation Notice: The Sonatype security research team discovered that the root cause of the vulnerability is in all versions of log4j:log4j, not just in the 1.2.x branch as the advisory states.
Detection
The application is vulnerable by using this component under the following circumstances:
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=2031667#c28
Recommendation
The 1.x.x component has reach End of Life, and users should upgrade to a non-vulnerable version of org.apache.logging.log4j:log4j-core as this component includes other security vulnerabilities that are not fixed.
References:
CVSS Score: 8.1
CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
MODERATE Vulnerabilities (1)
[CVE-2020-9488] Improper validation of certificate with host mismatch in Apache Log4j SMTP appen...
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.
CVSS Score: 3.7
CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
pkg:maven/log4j/[email protected]
CRITICAL Vulnerabilities (2)
CVE-2019-17571
[CVE-2019-17571] Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserializat...
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
CVSS Score: 9.8
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2021-4104
[CVE-2021-4104] JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when...
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
===================================================
The following information is provided by Sonatype Nexus Intelligence. Nexus Intelligence is the only security research service that performs "secondary expansion" to determine if newly discovered vulnerabilities are also present in other components.
Learn more about Nexus Intelligence -- https://www.sonatype.com/products/intelligence
Explanation
The log4j:log4j package is vulnerable to Deserialization of Untrusted Data. The lookup() and activateOptions() methods in the JMSAppender class allow JNDI lookup requests to be made when the TopicBindingName and TopicConnectionFactoryBindingName specify a trusted host. Lookups made to this host may be used by attackers to request a serialized malicious Java Object that can be deserialized and executed, leading to Remote Code Execution (RCE).
Note that this vulnerability is different from CVE-2021-44228 and requires the attacker to be in control of the third party host that is specified in the configuration, or write access to the Log4j configuration file in order to specify a malicious lookup host directly. This vulnerability also only affects the 1.x.x component of Log4j released under the log4j:log4j group and artifact IDs.
Advisory Deviation Notice: The Sonatype security research team discovered that the root cause of the vulnerability is in all versions of log4j:log4j, not just in the 1.2.x branch as the advisory states.
Detection
The application is vulnerable by using this component under the following circumstances:
Reference: https://bugzilla.redhat.com/show_bug.cgi?id=2031667#c28
Recommendation
The 1.x.x component has reach End of Life, and users should upgrade to a non-vulnerable version of org.apache.logging.log4j:log4j-core as this component includes other security vulnerabilities that are not fixed.
References:
CVSS Score: 8.1
CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
MODERATE Vulnerabilities (1)
[CVE-2020-9488] Improper validation of certificate with host mismatch in Apache Log4j SMTP appen...
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.
CVSS Score: 3.7
CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
|
I made similar changes on #20 so given the conflicts you may want to simply abandon this change. |
|
@al-niessner we probably just need to try this again but with the latest codebase |
|
Actually, I similarly had to rename all the sub modules and fix up the POMs to make it all self consistent that I am strong suggesting that keeping this is not all that useful and was giving you a graceful out with the conflicts. |
|
per tag-up closing this PR. will re-do |
🗒️ Summary
fixes #10
and clean the pom for better integration in multimodule project