Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[BP V6] Bug #12827: Fix cas access-log buffering #1860

Merged
merged 2 commits into from
Oct 29, 2024
Merged

[BP V6] Bug #12827: Fix cas access-log buffering #1860

merged 2 commits into from
Oct 29, 2024

Conversation

lgheribi
Copy link
Collaborator

Description

Désactivation du buffering des access-logs de CAS + fix du pattern de log (backport v6.x)

Contributeur

VAS (Vitam Accessible en Service)

@lgheribi lgheribi added the OPS REVIEW Mandatory if deployment/ directory is modified. label May 15, 2024
@lgheribi lgheribi added this to the IT 135 milestone May 15, 2024
@lgheribi lgheribi self-assigned this May 15, 2024
@vitam-devops
Copy link
Collaborator

Logo
Checkmarx One – Scan Summary & Details – 7360de80-7ac9-4665-b938-9785a13b119e

New Issues

Severity Issue Source File / Package Checkmarx Insight
HIGH CVE-2015-4852 Maven-commons-collections:commons-collections-3.2.1 Vulnerable Package
HIGH CVE-2015-6420 Maven-commons-collections:commons-collections-3.2.1 Vulnerable Package
HIGH CVE-2015-7501 Maven-commons-collections:commons-collections-3.2.1 Vulnerable Package
HIGH CVE-2016-2170 Maven-commons-collections:commons-collections-3.2.1 Vulnerable Package
HIGH CVE-2019-15599 Npm-tree-kill-1.2.1 Vulnerable Package
HIGH CVE-2020-13936 Maven-org.apache.velocity:velocity-1.7 Vulnerable Package
HIGH CVE-2020-28491 Maven-com.fasterxml.jackson.dataformat:jackson-dataformat-cbor-2.6.7 Vulnerable Package
HIGH CVE-2020-28502 Npm-xmlhttprequest-ssl-1.5.5 Vulnerable Package
HIGH CVE-2020-36048 Npm-engine.io-3.2.1 Vulnerable Package
HIGH CVE-2020-36049 Npm-socket.io-parser-3.2.0 Vulnerable Package
HIGH CVE-2020-7660 Npm-serialize-javascript-1.9.1 Vulnerable Package
HIGH CVE-2020-7788 Npm-ini-1.3.5 Vulnerable Package
HIGH CVE-2021-31597 Npm-xmlhttprequest-ssl-1.5.5 Vulnerable Package
HIGH CVE-2021-33813 Maven-org.jdom:jdom2-2.0.6 Vulnerable Package
HIGH CVE-2021-37136 Maven-io.netty:netty-codec-4.1.65.Final Vulnerable Package
HIGH CVE-2021-37137 Maven-io.netty:netty-codec-4.1.65.Final Vulnerable Package
HIGH CVE-2021-40690 Maven-org.apache.santuario:xmlsec-2.1.6 Vulnerable Package
HIGH CVE-2021-43466 Maven-org.thymeleaf:thymeleaf-spring5-3.0.12.RELEASE Vulnerable Package
HIGH CVE-2022-0265 Maven-com.hazelcast:hazelcast-4.2.2 Vulnerable Package
HIGH CVE-2022-2421 Npm-socket.io-parser-3.2.0 Vulnerable Package
HIGH CVE-2022-25857 Maven-org.yaml:snakeyaml-1.29 Vulnerable Package
HIGH CVE-2022-25857 Maven-org.yaml:snakeyaml-1.28 Vulnerable Package
HIGH CVE-2022-28366 Maven-net.sourceforge.htmlunit:neko-htmlunit-2.24 Vulnerable Package
HIGH CVE-2022-36437 Maven-com.hazelcast:hazelcast-4.2.2 Vulnerable Package
HIGH CVE-2022-42252 Maven-org.apache.tomcat.embed:tomcat-embed-core-9.0.63 Vulnerable Package
HIGH CVE-2022-45143 Maven-org.apache.tomcat.embed:tomcat-embed-core-9.0.63 Vulnerable Package
HIGH CVE-2023-24998 Maven-org.apache.tomcat.embed:tomcat-embed-core-9.0.63 Vulnerable Package
HIGH CVE-2023-6378 Maven-ch.qos.logback:logback-classic-1.2.9 Vulnerable Package
HIGH CVE-2023-6378 Maven-ch.qos.logback:logback-core-1.2.9 Vulnerable Package
HIGH CVE-2023-6481 Maven-ch.qos.logback:logback-core-1.2.9 Vulnerable Package
HIGH Client_DOM_XSS /cas/cas-server/src/main/resources/static/js/duo/Duo-Web-v2.min.js: 136 Attack Vector
HIGH Cxb3498186-093f Maven-org.freemarker:freemarker-2.3.29 Vulnerable Package
HIGH Cxb3498186-093f Maven-org.freemarker:freemarker-2.3.20 Vulnerable Package
HIGH Passwords And Secrets - Generic Password /vitamui_vars.yml: 298 Query to find passwords and secrets in infrastructure code.
HIGH Reflected_XSS_All_Clients /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/InternalSecurityService.java: 118 Attack Vector
HIGH Reflected_XSS_All_Clients /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/InternalSecurityService.java: 118 Attack Vector
MEDIUM Absolute_Path_Traversal /api/api-referential/referential-internal/src/main/java/fr/gouv/vitamui/referential/internal/server/rest/OntologyInternalController.java: 186 Attack Vector
MEDIUM Absolute_Path_Traversal /ui/ui-pastis/src/main/java/fr/gouv/vitamui/pastis/rest/ProfileController.java: 245 Attack Vector
MEDIUM Absolute_Path_Traversal /ui/ui-referential/src/main/java/fr/gouv/vitamui/referential/rest/RuleController.java: 219 Attack Vector
MEDIUM Absolute_Path_Traversal /ui/ui-commons/src/main/java/fr/gouv/vitamui/ui/commons/rest/RuleController.java: 211 Attack Vector
MEDIUM Absolute_Path_Traversal /ui/ui-pastis/src/main/java/fr/gouv/vitamui/pastis/rest/ArchivalProfileUnitController.java: 211 Attack Vector
MEDIUM Absolute_Path_Traversal /ui/ui-pastis/src/main/java/fr/gouv/vitamui/pastis/rest/PastisController.java: 99 Attack Vector
MEDIUM Absolute_Path_Traversal /api/api-referential/referential-external/src/main/java/fr/gouv/vitamui/referential/external/server/rest/ProfileExternalController.java: 209 Attack Vector
MEDIUM Absolute_Path_Traversal /api/api-referential/referential-internal/src/main/java/fr/gouv/vitamui/referential/internal/server/rest/ProfileInternalController.java: 199 Attack Vector
MEDIUM Absolute_Path_Traversal /api/api-referential/referential-internal/src/main/java/fr/gouv/vitamui/referential/internal/server/rest/FileFormatInternalController.java: 193 Attack Vector
MEDIUM Absolute_Path_Traversal /api/api-referential/referential-internal/src/main/java/fr/gouv/vitamui/referential/internal/server/rest/ArchivalProfileUnitInternalController.java: 153 Attack Vector
MEDIUM Absolute_Path_Traversal /api/api-referential/referential-external/src/main/java/fr/gouv/vitamui/referential/external/server/rest/ProfileExternalController.java: 150 Attack Vector
MEDIUM CVE-2016-10735 Npm-bootstrap-3.3.6 Vulnerable Package
MEDIUM CVE-2018-14040 Npm-bootstrap-3.3.6 Vulnerable Package
MEDIUM CVE-2018-14042 Npm-bootstrap-3.3.6 Vulnerable Package
MEDIUM CVE-2018-20676 Npm-bootstrap-3.3.6 Vulnerable Package
MEDIUM CVE-2018-20677 Npm-bootstrap-3.3.6 Vulnerable Package
MEDIUM CVE-2019-16769 Npm-serialize-javascript-1.9.1 Vulnerable Package
MEDIUM CVE-2019-8331 Npm-bootstrap-3.3.6 Vulnerable Package
MEDIUM CVE-2020-15366 Npm-ajv-6.10.0 Vulnerable Package
MEDIUM CVE-2020-15366 Npm-ajv-5.5.2 Vulnerable Package
MEDIUM CVE-2020-28481 Npm-socket.io-2.1.1 Vulnerable Package
MEDIUM CVE-2020-7693 Npm-sockjs-0.3.19 Vulnerable Package
MEDIUM CVE-2021-23364 Npm-browserslist-4.5.5 Vulnerable Package
MEDIUM CVE-2022-21704 Npm-log4js-4.5.1 Vulnerable Package
MEDIUM CVE-2022-24823 Maven-io.netty:netty-common-4.1.65.Final Vulnerable Package
MEDIUM CVE-2022-38749 Maven-org.yaml:snakeyaml-1.28 Vulnerable Package
MEDIUM CVE-2022-38749 Maven-org.yaml:snakeyaml-1.29 Vulnerable Package
MEDIUM CVE-2022-38750 Maven-org.yaml:snakeyaml-1.28 Vulnerable Package
MEDIUM CVE-2022-38750 Maven-org.yaml:snakeyaml-1.29 Vulnerable Package
MEDIUM CVE-2022-38751 Maven-org.yaml:snakeyaml-1.28 Vulnerable Package
MEDIUM CVE-2022-38751 Maven-org.yaml:snakeyaml-1.29 Vulnerable Package
MEDIUM CVE-2022-38752 Maven-org.yaml:snakeyaml-1.29 Vulnerable Package
MEDIUM CVE-2022-38752 Maven-org.yaml:snakeyaml-1.28 Vulnerable Package
MEDIUM CVE-2022-41854 Maven-org.yaml:snakeyaml-1.29 Vulnerable Package
MEDIUM CVE-2022-41854 Maven-org.yaml:snakeyaml-1.28 Vulnerable Package
MEDIUM CVE-2022-41940 Npm-engine.io-3.2.1 Vulnerable Package
MEDIUM CVE-2023-28708 Maven-org.apache.tomcat.embed:tomcat-embed-core-9.0.63 Vulnerable Package
MEDIUM CVE-2024-25710 Maven-org.apache.commons:commons-compress-1.21 Vulnerable Package
MEDIUM CVE-2024-26308 Maven-org.apache.commons:commons-compress-1.21 Vulnerable Package
MEDIUM Cleartext_Submission_of_Sensitive_Information /api/api-iam/iam-commons/src/main/java/fr/gouv/vitamui/iam/common/utils/IdentityProviderBuilder.java: 153 Attack Vector
MEDIUM Cleartext_Submission_of_Sensitive_Information /api/api-iam/iam-commons/src/main/java/fr/gouv/vitamui/iam/common/utils/IdentityProviderBuilder.java: 169 Attack Vector
MEDIUM Cleartext_Submission_of_Sensitive_Information /api/api-iam/iam-commons/src/main/java/fr/gouv/vitamui/iam/common/utils/IdentityProviderBuilder.java: 166 Attack Vector
MEDIUM Cleartext_Submission_of_Sensitive_Information /api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/user/service/UserEmailInternalService.java: 99 Attack Vector
MEDIUM Cleartext_Submission_of_Sensitive_Information /api/api-iam/iam-external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java: 79 Attack Vector
MEDIUM Cleartext_Submission_of_Sensitive_Information /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/provider/ExternalApiAuthenticationProvider.java: 88 Attack Vector
MEDIUM Client_Privacy_Violation /cas/cas-server/src/main/resources/static/js/passwordMeter.js: 23 Attack Vector
MEDIUM Container Traffic Not Bound To Host Interface /mongo_cluster.yml: 58 Incoming container traffic should be bound to a specific host interface
MEDIUM Container Traffic Not Bound To Host Interface /mongo_cluster.yml: 37 Incoming container traffic should be bound to a specific host interface
MEDIUM Container Traffic Not Bound To Host Interface /mongo_cluster.yml: 15 Incoming container traffic should be bound to a specific host interface
MEDIUM Cxf0b588a3-5c6f Npm-jquery-2.2.4 Vulnerable Package
MEDIUM Filtering_Sensitive_Logs /deployment/lib/mitogen-0.2.9/mitogen/core.py: 3286 Attack Vector
MEDIUM Filtering_Sensitive_Logs /deployment/lib/mitogen-0.2.9/mitogen/core.py: 3300 Attack Vector
MEDIUM Filtering_Sensitive_Logs /deployment/lib/mitogen-0.2.9/mitogen/core.py: 3300 Attack Vector
MEDIUM Filtering_Sensitive_Logs /deployment/lib/mitogen-0.2.9/mitogen/doas.py: 118 Attack Vector
MEDIUM Filtering_Sensitive_Logs /deployment/lib/mitogen-0.2.9/mitogen/core.py: 3286 Attack Vector
MEDIUM Filtering_Sensitive_Logs /deployment/lib/mitogen-0.2.9/mitogen/core.py: 809 Attack Vector
MEDIUM Filtering_Sensitive_Logs /deployment/lib/mitogen-0.2.9/mitogen/core.py: 809 Attack Vector
MEDIUM Filtering_Sensitive_Logs /deployment/lib/mitogen-0.2.9/mitogen/core.py: 809 Attack Vector
MEDIUM Filtering_Sensitive_Logs /deployment/lib/mitogen-0.2.9/mitogen/core.py: 3283 Attack Vector
MEDIUM Filtering_Sensitive_Logs /deployment/lib/mitogen-0.2.9/mitogen/core.py: 3300 Attack Vector
MEDIUM Filtering_Sensitive_Logs /deployment/lib/mitogen-0.2.9/mitogen/core.py: 3300 Attack Vector
MEDIUM Healthcheck Not Set /mongo_cluster.yml: 26 Check containers periodically to see if they are running properly.
MEDIUM Healthcheck Not Set /mongo_cluster.yml: 47 Check containers periodically to see if they are running properly.
MEDIUM HttpOnlyCookies /ui/ui-commons/src/main/java/fr/gouv/vitamui/ui/commons/security/CookieClearingLogoutHandler.java: 64 Attack Vector
MEDIUM Memory Not Limited /mongo_cluster.yml: 26 Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...
MEDIUM Memory Not Limited /mongo_cluster.yml: 47 Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than t...
MEDIUM Object_Access_Violation /deployment/lib/mitogen-0.2.9/mitogen/utils.py: 125 Attack Vector
MEDIUM Path_Traversal /deployment/lib/mitogen-0.2.9/mitogen/compat/tokenize.py: 451 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/InternalSecurityService.java: 118 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/InternalSecurityService.java: 118 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/InternalSecurityService.java: 110 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/InternalSecurityService.java: 118 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/InternalSecurityService.java: 118 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-security/src/main/java/fr/gouv/vitamui/iam/security/service/InternalSecurityService.java: 110 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/rest/CasInternalController.java: 183 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/rest/CasInternalController.java: 183 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-internal-client/src/main/java/fr/gouv/vitamui/iam/internal/client/UserInternalRestClient.java: 84 Attack Vector
MEDIUM Privacy_Violation /ui/ui-identity/src/main/java/fr/gouv/vitamui/identity/service/ProviderService.java: 214 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-commons/src/main/java/fr/gouv/vitamui/iam/common/utils/IdentityProviderBuilder.java: 111 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-commons/src/main/java/fr/gouv/vitamui/iam/common/utils/IdentityProviderBuilder.java: 110 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/idp/converter/IdentityProviderConverter.java: 155 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/rest/CasInternalController.java: 185 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-external-client/src/main/java/fr/gouv/vitamui/iam/external/client/CasExternalRestClient.java: 135 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-internal/src/main/java/fr/gouv/vitamui/iam/internal/server/rest/CasInternalController.java: 183 Attack Vector
MEDIUM Privacy_Violation /api/api-iam/iam-external/src/main/java/fr/gouv/vitamui/iam/external/server/rest/CasExternalController.java: 100

More results are available on AST platform

@lgheribi lgheribi changed the base branch from develop to master_6.x May 15, 2024 09:02
@GiooDev GiooDev modified the milestones: IT 135, IT 136 May 17, 2024
@GiooDev GiooDev modified the milestones: IT 136, IT 137 Jun 12, 2024
@GiooDev
Copy link
Contributor

GiooDev commented Sep 19, 2024

On merge ? :)

@GiooDev GiooDev modified the milestones: IT 137, IT 143 Oct 28, 2024
@GiooDev GiooDev merged commit f6b459a into master_6.x Oct 29, 2024
1 check passed
@GiooDev GiooDev deleted the bug_12827_6.x branch October 29, 2024 08:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@GiooDev GiooDev GiooDev approved these changes

@bbenaissa bbenaissa bbenaissa approved these changes

@ebernard ebernard ebernard approved these changes

Assignees

@lgheribi lgheribi

Labels
OPS REVIEW Mandatory if deployment/ directory is modified.
Projects
None yet
Milestone
IT 143
Development

Successfully merging this pull request may close these issues.
5 participants
@lgheribi @vitam-devops @GiooDev @ebernard @bbenaissa