[GHSA-8hmh-mhqv-7638] PartialBufferOutputStream2 in GeoServer before 1.6.1 and...

[jodygarnett]

Updates

• Affected products
• References
• Summary

Comments
Updating the link to the geoserver issue tracker, adding maven ecosystem coordinates reflecting projects current best practices.

[darakian]

Many thanks! 👍

[advisory-database]

Hi @jodygarnett! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!

[jodygarnett]

any idea on considering this just as bug rather than a security problem? Really it is a complaint about lack of a useful error message ....

[darakian]

Well.... it actually wasn't in our database until I merged this PR. That said the appropriate way to go about getting it de-listed would be to reach out to the assigning CNA which looks to be mitre in this case
https://nvd.nist.gov/vuln/detail/CVE-2008-7227

They have a web form here https://cveform.mitre.org/ that you can file an issue with. If you'd like to give that a try and let me know how it goes we can either reflect their change (hopefully) or we can reconsider this advisory on our end independently.

[jodygarnett]

Thanks, I filled in the form we will see what happens.

[jodygarnett]

Response:

Thank you for contacting us. We have read and understood your comments
about CVE-2008-7227. However, in accordance with our published policy
in the
https://www.cve.org/Resources/Roles/Cnas/CVE-Record-Management-Guidelines.pdf
"Modification of Historical CVE Data" section, the CVE Program will
not be taking any action to modify CVE-2008-7227.

[darakian]

Bleh. Ok, so for the benefit of the historical record can you lay out the case for this not having any security impact? Looking at the issue https://osgeo-org.atlassian.net/browse/GEOS-1747 I see

This may lead to failure to report service exception if the code encoding the output calls flush() before having written the full contents to the output

Which I could read as a vector to expose program memory, but also it sounds like the buffer eventually gets fully flushed anyway. Can you expand on the implications here? Also if you have a fix commit or something that could be inspected that would be great.

[jodygarnett]

I will update the GEOS-1747 ticket to be clear there is no security impact; indeed just no information rather than a helpful failure :P

The changes you have merged describing the maven package affected and so on to bring this up to modern norms still has value.

[jodygarnett]

Q: As a CNA to follow the policy on historical stuff do you need to revert this PR?

[darakian]

My plan (so long as it does look like there is no security impact) is to withdraw the GHSA we have in our system. We have no control over the CVE itself, but by marking the GHSA as withdrawn will halt dependabot alerts.

[jodygarnett]

Nice, I support your plan. And I learned something :)

[darakian]

Cool. So, I see the ticket is updated. One clarifying question; the buffer which gets flushed only ever has data which is intended to be flushed eventually anyway right? The early flush as described in the bug is only an issue because it's unclear to the caller/receiver that what they're getting is incomplete?

[jodygarnett]

Yes, this setting is part of the low-level “dispatcher” system which predates spring-framework and is unique for this application.

For the majority of these geospatial XML protocols it is obvious that something is wrong because the xml stream that they are parsing gets cut off as they are receiving it. But when serving large geospatial datasets stream is required as the content will not all fit into memory at the same time…

The service exception for these protocols is a different XML document. So if you have already started producing a document there is no good solutions.

The partial buffer solution recommended is a good compromise, often a problem is visible within the first little bit of streaming. It is rare that some invalid data midway through the answer would cause a “service exception”.

So the partial document is all information the requester expected to see, and was authorized to see, it is just the result is incomplete.

[darakian]

Gotcha. Many thanks for the clarification. 👍
GHSA-8hmh-mhqv-7638