search

SORMAS-Foundation / SORMAS-Project

SORMAS (Surveillance, Outbreak Response Management and Analysis System) is an early warning and management system to fight the spread of infectious diseases.
https://sormas.org
GNU General Public License v3.0
293 stars 143 forks source link

Address Software Dependencies are Affected by Known Vulnerabilities #3580

Closed vidi42 closed 3 years ago

vidi42 commented 4 years ago

Problem Description

The target application uses dependencies that are affected by known vulnerabilities. Applications that use dependencies which are affected by known vulnerabilities offer an additional attack surface. Known vulnerabilities could provide a generic path to compromise the application in different ways, such as extracting sensitive information, manipulating internal application states, or even compromising the underlying operating system. Depending on the vulnerability and the affected software component, they might be publicly available proof-of-concept exploits. Such vulnerabilities are very likely to be exploited, especially on services that are exposed to the Internet where the exploitation could be automated.

The following list of dependencies with known vulnerabilities has been identified:

These libraries were extracted from the release version 1.48.2 of sormas-ui, sormas-ear and sormas-rest. The current OWASP Dependency Checks also show quite a lot possible vulnarabilities (about 90) in used dependencies (java libraries).

Proposed Change

  1. Check which findings might be solved by a newer library version. Some might already be cleaned by #3449.
  2. Assess which findings are not a vulnarability in our setup (effectifly a false positive).
  3. Document which findings will not be addressed in a simple version update due to more complex changes or risks.

System Details

Additional information

Check this after #3449 and #3584 are done because some version updates there will resolve findings.

JonasCir commented 4 years ago

uh not good. I think we should enable GitHub's automatic dependabot alerts for this (and all other) repositories, if possible

JonasCir commented 4 years ago

GitHub sends Dependabot alerts when we detect vulnerabilities affecting your repository.

@fhauptmann and @MartinWahnschaffeSymeda any comments?

Edit: GitHub seems to offer more security features, even static security analysis which might prevent things like #3578

MateStrysewske commented 4 years ago

@JonasCir Dependabot should already be enabled

JonasCir commented 4 years ago

Hm, then I propose to investigate why this was not caught . The CVEs are published in GitHub Advisory DB and some of them are rated as severe.

StefanKock commented 3 years ago

For Dependency Check false positives can be suppressed:

StefanKock commented 3 years ago

Current findings not (all) fixed by #3584:

False positives:

Not exploitable:

HolgerReiseVSys commented 3 years ago

maven-ant-tasks is used for automating some common tasks during development. It is not part of the release and is not relied on by the code, tests or the CI pipeline.

According to https://maven.apache.org/ant-tasks/ it has been superseded by Maven Artifact Resolver Ant Tasks.

StefanKock commented 3 years ago

Evaluation of findings in the comment above, to be discussed with @MartinWahnschaffeSymeda

StefanKock commented 3 years ago

Open findings will be addressed in new tickets (especially Keycloak 12 is not available yet): #3765, #3766

StefanKock commented 3 years ago

Documented all not relevant findings (https://github.com/hzi-braunschweig/SORMAS-Project/issues/3580#issuecomment-740562116) in check-suppressions.xml to exclude them in Dependency-Check on Jenkins, successfully tested.

StefanKock commented 3 years ago

I needed to add this argument for Dependency-Check in Jenkins, I forgot that on monday: --suppression ${WORKSPACE}/sormas-base/dependencies/check-suppressions.xml