-
Notifications
You must be signed in to change notification settings - Fork 2.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Added refs and moved NVD information to concept
Fixed NVD ref
- Loading branch information
1 parent
3f91b7d
commit 9015137
Showing
4 changed files
with
194 additions
and
145 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
138 changes: 138 additions & 0 deletions
138
docs/src/main/asciidoc/security-vulnerability-detection-concept.adoc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,138 @@ | ||
| //// | ||
| This document is maintained in the main Quarkus repository | ||
| and pull requests should be submitted there: | ||
| https://github.com/quarkusio/quarkus/tree/main/docs/src/main/asciidoc | ||
| //// | ||
|
|
||
| [id="security-vulnerability-detection-concept"] | ||
| = Security vulnerability detection and reporting in Quarkus | ||
| include::_attributes.adoc[] | ||
| :categories: security,contributing | ||
|
|
||
| Most of the Quarkus tags are registered in the US link:https://nvd.nist.gov[National Vulnerability Database (NVD)] in Common Platform Enumeration (CPE) name format. | ||
|
|
||
| === US National Vulnerability Database | ||
|
|
||
| To view the registered Quarkus CPE names in the US NVD, use the following search URL: | ||
|
|
||
| https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=quarkus | ||
|
|
||
| If the NVE database flags a CVE against a Quarkus tag, a link that provides more details about the CVE is added to the given CPE name entry. | ||
|
|
||
| The NVD CPE team updates the list regularly, but if you encounter a false positive, report the details by creating an issue in the link:https://github.com/quarkusio/quarkus/issues/2611[quarkusio] repository. | ||
|
|
||
| == Detecting vulnerabilities in Quarkus at build time | ||
|
|
||
| You can detect the vulnerabilities at the application build time with an NVD feed by using the Maven link:https://jeremylong.github.io/DependencyCheck/dependency-check-maven/[OWASP Dependency check plugin]. | ||
|
|
||
|
|
||
| To add the OWASP Dependency check plugin to your Quarkus Maven project, add the following XML configuration to the `pom.xml` file: | ||
|
|
||
| [source,xml] | ||
| ---- | ||
| <plugin> | ||
| <groupId>org.owasp</groupId> | ||
| <artifactId>dependency-check-maven</artifactId> | ||
| <version>${owasp-dependency-check-plugin.version}</version> | ||
| </plugin> | ||
| ---- | ||
|
|
||
| [IMPORTANT] | ||
| ==== | ||
| Set the `owasp-dependency-check-plugin.version` value to `7.4.4` or later. | ||
| ==== | ||
|
|
||
| Next, configure the plugin as follows: | ||
|
|
||
| [source,xml] | ||
| ---- | ||
| <plugin> | ||
| <groupId>org.owasp</groupId> | ||
| <artifactId>dependency-check-maven</artifactId> | ||
| <version>${owasp-dependency-check-plugin.version}</version> | ||
| <configuration> | ||
| <!-- Fail only when detecting High Vulnerability issues --> | ||
| <failBuildOnCVSS>7</failBuildOnCVSS> | ||
| <suppressionFiles> | ||
| <suppressionFile>${project.basedir}/dependency-cpe-suppression.xml</suppressionFile> | ||
| </suppressionFiles> | ||
| </configuration> | ||
| </plugin> | ||
| ---- | ||
|
|
||
| To detect less severe issues, adjust the value of `failBuildOnCVSS` to suppress the false positives, as demonstrated in the following code sample: | ||
| [source,xml] | ||
| ---- | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd"> | ||
| <!-- | ||
| This is a CPE suppression file for the maven dependency check plugin. | ||
| Each CPE that is found by error (false positive) needs to be suppressed for a specific jar using its' GAV. | ||
| See https://jeremylong.github.io/DependencyCheck/general/suppression.html | ||
| --> | ||
| <suppress> | ||
| <notes> | ||
| <![CDATA[ | ||
| Suppress the false positive CPE for netty-tcnative-classes to netty | ||
| ]]> | ||
| </notes> | ||
| <gav regex="true">^io\.netty:netty-tcnative-classes.*:.*$</gav> | ||
| <cpe>cpe:/a:netty:netty</cpe> | ||
| </suppress> | ||
| <suppress> | ||
| <notes> | ||
| <![CDATA[ | ||
| Suppress the false positive CPE for Quarkus Mutiny to mutiny:mutiny | ||
| ]]> | ||
| </notes> | ||
| <gav regex="true">^io\.quarkus:quarkus-mutiny.*:.*$</gav> | ||
| <cpe>cpe:/a:mutiny:mutiny</cpe> | ||
| </suppress> | ||
| <suppress> | ||
| <notes> | ||
| <![CDATA[ | ||
| Suppress the false positive CPE for Smallrye Mutiny to mutiny:mutiny | ||
| ]]> | ||
| </notes> | ||
| <gav regex="true">^io\.smallrye.reactive:mutiny.*:.*$</gav> | ||
| <cpe>cpe:/a:mutiny:mutiny</cpe> | ||
| </suppress> | ||
| <suppress> | ||
| <notes> | ||
| <![CDATA[ | ||
| Suppress the false positive CPE for Smallrye Mutiny to mutiny:mutiny | ||
| ]]> | ||
| </notes> | ||
| <gav regex="true">^io\.smallrye.reactive:smallrye-mutiny.*:.*$</gav> | ||
| <cpe>cpe:/a:mutiny:mutiny</cpe> | ||
| </suppress> | ||
| <suppress> | ||
| <notes> | ||
| <![CDATA[ | ||
| Suppress the false positive CPE for Smallrye Mutiny to mutiny:mutiny | ||
| ]]> | ||
| </notes> | ||
| <gav regex="true">^io\.smallrye.reactive:vertx-mutiny.*:.*$</gav> | ||
| <cpe>cpe:/a:mutiny:mutiny</cpe> | ||
| </suppress> | ||
| <suppress> | ||
| <notes> | ||
| <![CDATA[ | ||
| Suppress the false positive CPE for graal-sdk to GraalVM (the JVM distribution) | ||
| ]]> | ||
| </notes> | ||
| <gav regex="true">^org\.graalvm\.sdk:g like this | ||
| </suppress> | ||
| </suppressions> | ||
| ---- | ||
|
|
||
| Ensure that you review and update the suppression list regularly to ensure that the results are up to date. | ||
| You can optionally apply a time limit to individual suppressions by adding an expiry attribute, as outlined in the following example: | ||
|
|
||
| `<suppress until="2022-01-01Z">...</suppress>` | ||
| You can adjust the expiry date if you need to. | ||
|
|
||
| == References | ||
|
|
||
| * xref:security-overview-concept.adoc[Quarkus Security overview] | ||
| * xref:security-authentication-mechanisms-concept.adoc#other-supported-authentication-mechanisms[Authentication mechanisms in Quarkus] |