CVE-2022-41853, CVE-2016-1000027, GHSA-jgvc-jfgh-rjvv

[sean-redmond]

Here's what I did

 trivy image openrouteservice/openrouteservice:nightly

---

Here's what I got

openrouteservice/openrouteservice:nightly (alpine 3.17.3)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

2023-06-06T14:39:56.335+0300	INFO	Table result includes only package filenames. Use '--format json' option to get the full path to the package file.

Java (jar)

Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 2)

┌──────────────────────────────────────────┬─────────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────┐
│                 Library                  │    Vulnerability    │ Severity │ Installed Version │ Fixed Version │                          Title                          │
├──────────────────────────────────────────┼─────────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────┤
│ org.bitbucket.b_c:jose4j (ors.war)       │ GHSA-jgvc-jfgh-rjvv │ MEDIUM   │ 0.7.9             │ 0.9.3         │ Chosen Ciphertext Attack in Jose4j                      │
│                                          │                     │          │                   │               │ https://github.com/advisories/GHSA-jgvc-jfgh-rjvv       │
├──────────────────────────────────────────┼─────────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────┤
│ org.hsqldb:hsqldb (ors.war)              │ CVE-2022-41853      │ CRITICAL │ 2.5.2             │ 2.7.1         │ Untrusted input may lead to RCE attack                  │
│                                          │                     │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-41853              │
├──────────────────────────────────────────┼─────────────────────┤          ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────┤
│ org.springframework:spring-web (ors.war) │ CVE-2016-1000027    │          │ 5.3.27            │ 6.0.0         │ spring: HttpInvokerServiceExporter readRemoteInvocation │
│                                          │                     │          │                   │               │ method untrusted java deserialization                   │
│                                          │                     │          │                   │               │ https://avd.aquasec.com/nvd/cve-2016-1000027            │
└──────────────────────────────────────────┴─────────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────┘

---

Here's what I was expecting

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

---

Here's what I think could be improved

Bump package versions to resolve, the spring framework one could be more difficult as it looks to be a major version

[sean-redmond]

It seems jose4j version can be resolved by bumping to <kafka.version>3.4.1</kafka.version> from current <kafka.version>3.4.0</kafka.version>

This is just based on analysis of the pom.xml in the master branch using mvn dependency:tree | less t find what is pulling in jose4j then using mvn versions:display-dependency-updates -DgroupId=org.apache.kafka -DartifactId=kafka to check the version bump options.

3.4.1 deps:

3.4.0 deps:

[MichaelsJP]

@sean-redmond Thanks for reporting. I'll quickly look into it.

Will be fixed in #1464

[sean-redmond]

I think the PR only resolves GHSA-jgvc-jfgh-rjvv looks like CVE-2022-41853 & CVE-2016-1000027 remain - sorry I don't think my comment was clear that updating kafka only resolved one of them

[MichaelsJP]

@sean-redmond

• CVE-2016-1000027 this is a false positive for spring-boot 2.7.14 and our configuration of it.
  As you can see here Sonatype vulnerability CVE-2016-1000027 in Spring-web project spring-projects/spring-framework#24434 (comment) the CVE is only relevant when using the org.springframework.remoting.httpinvoker package, which we don't. It'll definitely disappear, once we upgrade to spring-boot 3.x. This should happen in the near future.

• CVE-2022-41853 is introduced by org.geotools.gt-epsg-hsql 29.0 and can be fixed as soon as they update it.

Maybe it's possible to exclude the affected packages, but I don't know if it's worth it. Do you have any hard limits?