Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE November 2024 #4933

Closed
wants to merge 16 commits into from
Closed

CVE November 2024 #4933

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
4f36121
Replace alpine with jdk-slim.
jaredb96 Nov 18, 2024
74e8fce
Remove apk update.
jaredb96 Nov 18, 2024
01646c3
Revert to alpine.
jaredb96 Nov 18, 2024
92536fc
Apk upgrade commands.
jaredb96 Nov 18, 2024
b1d8873
Remove ssl add.
jaredb96 Nov 18, 2024
fffd859
Netty common update.
jaredb96 Nov 25, 2024
5b79497
Remove comment.
jaredb96 Nov 25, 2024
4debbc7
Remove netty common fix.
jaredb96 Nov 26, 2024
9dd6035
Remove netty common fix.
jaredb96 Nov 26, 2024
f218be6
Add 32.0.0-android to build.sbt (does not work).
jaredb96 Nov 29, 2024
6e94eb4
Use ThisBuild on build.sbt (does not work).
jaredb96 Nov 29, 2024
b48dd47
Add guava exclude.
jaredb96 Nov 29, 2024
a9d07ac
Correct guava version.
jaredb96 Nov 29, 2024
6c1b304
Merge branch 'master' into cve-nov-2024-release
jaredb96 Dec 2, 2024
efb2a1e
Netty common cve resolution.
jaredb96 Dec 2, 2024
5e9c53c
Keycloak cve resolution.
jaredb96 Dec 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
184 changes: 106 additions & 78 deletions build.sbt
View file
Open in desktop
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Resolves CVE-2023-2976 and CVE-2024-21742

Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,9 @@ lazy val dockerSettings = Seq(
dockerBaseImage := "eclipse-temurin:21.0.2_13-jdk-alpine",
dockerRepository := Some("hmda"),
dockerCommands := dockerCommands.value.flatMap {
case cmd@Cmd("FROM",_) => List(cmd, Cmd("RUN", "apk update"),
case cmd@Cmd("FROM",_) => List(cmd,
Cmd("RUN", "apk update"),
Cmd("RUN", "apk upgrade"),
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Resolves CVE-2024-5535, CVE-2024-45492, and CVE-2024-45491 - all critical cves

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This actually resolves the majority of the critical / high cves:

CVE-2024-5535 (libcrypto3, libssl3)
CVE-2024-45492, CVE-2024-45491 (libexpat)
CVE-2024-6119 (libcrypto3, libssl3)
CVE-2024-4603 (libcrypto3, libssl3)
CVE-2024-4741, CVE-2024-2511 (libcrypto3, libssl3)

Current cves:

NAME                INSTALLED       FIXED-IN                                              TYPE          VULNERABILITY        SEVERITY 
apache-mime4j-core  0.8.9           0.8.10                                                java-archive  GHSA-jw7r-rxff-gv24  Medium    
guava               31.0.1-android  32.0.0-android                                        java-archive  GHSA-7g45-4rm6-3mm3  Medium    
guava               31.0.1-android  32.0.0-android                                        java-archive  GHSA-5mg8-w23w-74h3  Low       
keycloak-core       25.0.3          25.0.4                                                java-archive  GHSA-xmmm-jw76-q7vg  Medium    
netty-common        4.1.94.Final    4.1.115                                               java-archive  GHSA-xq3w-v528-46rv  High      
openjdk             21.0.2+13-LTS   1.8.0_422, 11.0.24, 17.0.12, 21.0.4, 22.0.2, 8.0.422  binary        CVE-2024-21147       High      
openjdk             21.0.2+13-LTS   1.8.0_432, 11.0.25, 17.0.13, 21.0.5, 23.0.1, 8.0.432  binary        CVE-2024-21235       Medium    
openjdk             21.0.2+13-LTS   1.8.0_422, 11.0.24, 17.0.12, 21.0.4, 22.0.2, 8.0.422  binary        CVE-2024-21145       Medium    
openjdk             21.0.2+13-LTS   1.8.0_422, 11.0.24, 17.0.12, 21.0.4, 22.0.2, 8.0.422  binary        CVE-2024-21140       Medium    
openjdk             21.0.2+13-LTS   1.8.0_432, 11.0.25, 17.0.13, 21.0.5, 23.0.1, 8.0.432  binary        CVE-2024-21217       Low       
openjdk             21.0.2+13-LTS   1.8.0_432, 11.0.25, 17.0.13, 21.0.5, 23.0.1, 8.0.432  binary        CVE-2024-21210       Low       
openjdk             21.0.2+13-LTS   1.8.0_432, 11.0.25, 17.0.13, 21.0.5, 23.0.1, 8.0.432  binary        CVE-2024-21208       Low       
openjdk             21.0.2+13-LTS   1.8.0_422, 11.0.24, 17.0.12, 21.0.4, 22.0.2, 8.0.422  binary        CVE-2024-21138       Low       
openjdk             21.0.2+13-LTS   1.8.0_422, 11.0.24, 17.0.12, 21.0.4, 22.0.2, 8.0.422  binary        CVE-2024-21131       Low       
openjdk             21.0.2+13-LTS   1.8.0_412, 11.0.23, 17.0.11, 21.0.3, 22.0.1, 8.0.412  binary        CVE-2024-21094       Low       
openjdk             21.0.2+13-LTS   1.8.0_412, 11.0.23, 17.0.11, 21.0.3, 22.0.1, 8.0.412  binary        CVE-2024-21068       Low       
openjdk             21.0.2+13-LTS   11.0.23, 17.0.11, 21.0.3, 22.0.1                      binary        CVE-2024-21012       Low       
openjdk             21.0.2+13-LTS   1.8.0_412, 11.0.23, 17.0.11, 21.0.3, 22.0.1, 8.0.412  binary        CVE-2024-21011       Low       
zookeeper           3.8.3           3.8.4                                                 java-archive  GHSA-r978-9m6m-6gm6  Medium

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @jaredb96 ; would it be worth upgrading the base image at this point? looks like eclipse-temurin:23.0.1_11-jdk-alpine resolves all the critical CVEs (and it also seems to run an "apk update" internally). We could of course try going back a bit farther if we don't want an image pushed yesterday...

Cmd("RUN", "rm /var/cache/apk/*"))
case other => List(other)
}
Expand Down Expand Up @@ -224,45 +226,45 @@ lazy val `check-digit` = (project in file("check-digit"))
.dependsOn(common % "compile->compile;test->test")
.dependsOn(`hmda-protocol` % "compile->compile;test->test")

lazy val `file-proxy` = (project in file("file-proxy"))
.enablePlugins(
JavaServerAppPackaging,
sbtdocker.DockerPlugin,
AshScriptPlugin
)
.settings(hmdaBuildSettings: _*)
.settings(
Seq(
libraryDependencies ++= commonDeps ++ akkaDeps ++ akkaHttpDeps ++ circeDeps ++ slickDeps ++
lazy val `file-proxy` = (project in file("file-proxy"))
.enablePlugins(
JavaServerAppPackaging,
sbtdocker.DockerPlugin,
AshScriptPlugin
)
.settings(hmdaBuildSettings: _*)
.settings(
Seq(
libraryDependencies ++= commonDeps ++ akkaDeps ++ akkaHttpDeps ++ circeDeps ++ slickDeps ++
enumeratumDeps :+ monix :+ lettuce :+ scalaJava8Compat :+ scalaMock,
Compile / mainClass := Some("hmda.proxy.FileProxy"),
assembly / assemblyJarName := {
s"${name.value}.jar"
},
assembly/ assemblyMergeStrategy := {
case "application.conf" => MergeStrategy.concat
case "META-INF/io.netty.versions.properties" => MergeStrategy.concat
case "META-INF/MANIFEST.MF" => MergeStrategy.discard
case PathList("META-INF", xs@_*) => MergeStrategy.concat
case PathList("org", "bouncycastle", xs @_*) => MergeStrategy.first
case PathList("jakarta", xs@_*) => MergeStrategy.last
case PathList(ps @ _*) if ps.last endsWith ".proto" =>
MergeStrategy.first
case "module-info.class" => MergeStrategy.concat
case x if x.endsWith("/module-info.class") => MergeStrategy.concat
case x if x.endsWith("/LineTokenizer.class") => MergeStrategy.concat
case x if x.endsWith("/LogSupport.class") => MergeStrategy.concat
case x if x.endsWith("/MailcapFile.class") => MergeStrategy.concat
case x if x.endsWith("/MimeTypeFile.class") => MergeStrategy.concat
case x =>
val oldStrategy = (assembly / assemblyMergeStrategy).value
oldStrategy(x)
}
),
dockerSettings,
packageSettings
)
.dependsOn(common % "compile->compile;test->test")
Compile / mainClass := Some("hmda.proxy.FileProxy"),
assembly / assemblyJarName := {
s"${name.value}.jar"
},
assembly/ assemblyMergeStrategy := {
case "application.conf" => MergeStrategy.concat
case "META-INF/io.netty.versions.properties" => MergeStrategy.concat
case "META-INF/MANIFEST.MF" => MergeStrategy.discard
case PathList("META-INF", xs@_*) => MergeStrategy.concat
case PathList("org", "bouncycastle", xs @_*) => MergeStrategy.first
case PathList("jakarta", xs@_*) => MergeStrategy.last
case PathList(ps @ _*) if ps.last endsWith ".proto" =>
MergeStrategy.first
case "module-info.class" => MergeStrategy.concat
case x if x.endsWith("/module-info.class") => MergeStrategy.concat
case x if x.endsWith("/LineTokenizer.class") => MergeStrategy.concat
case x if x.endsWith("/LogSupport.class") => MergeStrategy.concat
case x if x.endsWith("/MailcapFile.class") => MergeStrategy.concat
case x if x.endsWith("/MimeTypeFile.class") => MergeStrategy.concat
case x =>
val oldStrategy = (assembly / assemblyMergeStrategy).value
oldStrategy(x)
}
),
dockerSettings,
packageSettings
)
.dependsOn(common % "compile->compile;test->test")


lazy val `institutions-api` = (project in file("institutions-api"))
Expand Down Expand Up @@ -591,46 +593,46 @@ lazy val `hmda-analytics` = (project in file("hmda-analytics"))
)
.dependsOn(common % "compile->compile;test->test")

lazy val `hmda-auth` = (project in file("hmda-auth"))
.enablePlugins(
JavaServerAppPackaging,
sbtdocker.DockerPlugin,
AshScriptPlugin
)
.settings(hmdaBuildSettings: _*)
.settings(
Seq(
libraryDependencies ++= keycloakServerDeps,
Compile / mainClass := Some("hmda.authService.HmdaAuth"),
assembly / assemblyJarName := {
s"${name.value}.jar"
},
assembly / assemblyMergeStrategy := {
case "application.conf" => MergeStrategy.concat
case "META-INF/io.netty.versions.properties" => MergeStrategy.concat
case "META-INF/MANIFEST.MF" => MergeStrategy.discard
case PathList("META-INF", xs @ _*) => MergeStrategy.concat
case PathList("org", "bouncycastle", xs @_*) => MergeStrategy.first
case PathList("jakarta", xs @ _*) => MergeStrategy.last
case "reference.conf" => MergeStrategy.concat
case PathList(ps @ _*) if ps.last endsWith ".proto" =>
MergeStrategy.first
case "module-info.class" => MergeStrategy.concat
case x if x.endsWith("/module-info.class") => MergeStrategy.concat
case x if x.endsWith("/LineTokenizer.class") => MergeStrategy.concat
case x if x.endsWith("/LogSupport.class") => MergeStrategy.concat
case x if x.endsWith("/MailcapFile.class") => MergeStrategy.concat
case x if x.endsWith("/MimeTypeFile.class") => MergeStrategy.concat
case x =>
lazy val `hmda-auth` = (project in file("hmda-auth"))
.enablePlugins(
JavaServerAppPackaging,
sbtdocker.DockerPlugin,
AshScriptPlugin
)
.settings(hmdaBuildSettings: _*)
.settings(
Seq(
libraryDependencies ++= keycloakServerDeps,
Compile / mainClass := Some("hmda.authService.HmdaAuth"),
assembly / assemblyJarName := {
s"${name.value}.jar"
},
assembly / assemblyMergeStrategy := {
case "application.conf" => MergeStrategy.concat
case "META-INF/io.netty.versions.properties" => MergeStrategy.concat
case "META-INF/MANIFEST.MF" => MergeStrategy.discard
case PathList("META-INF", xs @ _*) => MergeStrategy.concat
case PathList("org", "bouncycastle", xs @_*) => MergeStrategy.first
case PathList("jakarta", xs @ _*) => MergeStrategy.last
case "reference.conf" => MergeStrategy.concat
case PathList(ps @ _*) if ps.last endsWith ".proto" =>
MergeStrategy.first
case "module-info.class" => MergeStrategy.concat
case x if x.endsWith("/module-info.class") => MergeStrategy.concat
case x if x.endsWith("/LineTokenizer.class") => MergeStrategy.concat
case x if x.endsWith("/LogSupport.class") => MergeStrategy.concat
case x if x.endsWith("/MailcapFile.class") => MergeStrategy.concat
case x if x.endsWith("/MimeTypeFile.class") => MergeStrategy.concat
case x =>
val oldStrategy = (assembly / assemblyMergeStrategy).value
oldStrategy(x)
}
),
dockerSettings,
packageSettings
)
.dependsOn(common % "compile->compile;test->test")
.dependsOn(`institutions-api` % "compile->compile;test->test")
}
),
dockerSettings,
packageSettings
)
.dependsOn(common % "compile->compile;test->test")
.dependsOn(`institutions-api` % "compile->compile;test->test")

lazy val `rate-limit` = (project in file("rate-limit"))
.enablePlugins(
Expand Down Expand Up @@ -816,4 +818,30 @@ lazy val `hmda-quarterly-data-service` = (project in file ("hmda-quarterly-data-
packageSettings
)
.dependsOn(common % "compile->compile;test->test")
.dependsOn(`hmda-protocol` % "compile->compile;test->test")
.dependsOn(`hmda-protocol` % "compile->compile;test->test")

ThisBuild / libraryDependencies += "com.google.guava" % "guava" % "32.0.0-android"

libraryDependencies ++= Seq(
"com.datastax.oss" % "java-driver-core" % "4.15.0" exclude ("com.google.guava", "guava"),
"com.datastax.oss" % "java-driver-shaded-guava" % "25.1-jre-graal-sub-1" exclude ("com.google.guava", "guava"),
"com.google.guava" % "guava" % "32.0.0-android"
)

ThisBuild / libraryDependencies += "io.netty" % "netty-common" % "4.1.115.Final"

libraryDependencies ++= Seq(
"io.netty" % "netty-common" % "4.1.94.Final" exclude ("io.netty", "netty-common"),
"io.netty" % "netty-transport-native-unix-common" % "4.1.94.Final" exclude ("io.netty", "netty-common"),
"io.netty" % "netty-common" % "4.1.115.Final"
)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Resolves keycloak cve - (GHSA-93ww-43rr-79v3)

libraryDependencies ++= Seq(
"org.keycloak" % "keycloak-crypto-default" % "25.0.3" exclude ("org.keycloak", "keycloak-core"),
"org.keycloak" % "keycloak-server-spi" % "25.0.3" exclude ("org.keycloak", "keycloak-core"),
"org.keycloak" % "keycloak-server-spi-private" % "25.0.3" exclude ("org.keycloak", "keycloak-core"),
"org.keycloak" % "keycloak-adapter-core" % "25.0.3" exclude ("org.keycloak", "keycloak-core"),
"org.keycloak" % "keycloak-admin-client" % "25.0.3" exclude ("org.keycloak", "keycloak-core"),
"org.keycloak" % "keycloak-common" % "25.0.3" exclude ("org.keycloak", "keycloak-core"),
"org.keycloak" % "keycloak-core" % "26.0.6"
)
2 changes: 1 addition & 1 deletion project/Version.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ object Version {
val lettuce = "6.2.4.RELEASE"
val java8Compat = "1.0.2"
val scalaMock = "4.3.0"
val guava = "33.0.0-jre"
val guava = "32.0.0-android"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there aren't any concerns switching between the JRE and Android version of this library?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @jaredb96 , checking https://github.com/google/guava and it does seem like the "-jre" version is intended for JRE-based builds. Looks like guava is up to v33.3.1. What does grype say if you put in 33.3.1-jre?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, looks like scala itself was bringing in the android dep! That's weird... This removes the guava problem from the grype output.

-      libraryDependencies += zeroAllocationHashing,
+      libraryDependencies ++= List("com.google.guava" % "guava" % "33.3.1-jre", zeroAllocationHashing),

val awsSesSdk = "1.12.484"
val zeroAllocation = "0.16"
val cormorant = "0.3.0"
Expand Down
Loading