Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(tools/quorum-all-in-one): address CVE-2021-36159 and CVE-2022-28391 #2059

Closed
zondervancalvez opened this issue Jun 1, 2022 · 2 comments · Fixed by #2240
Closed

fix(tools/quorum-all-in-one): address CVE-2021-36159 and CVE-2022-28391 #2059

zondervancalvez opened this issue Jun 1, 2022 · 2 comments · Fixed by #2240
Labels
dependencies Pull requests that update a dependency file P4 Priority 4: Low Quorum Security Related to existing or potential security vulnerabilities

Comments

@zondervancalvez
Copy link
Contributor

zondervancalvez commented Jun 1, 2022 •
edited
Loading

List of vulnerabilities found in quorum-all-in-one image during Azure Container scan.

VULNERABILITY ID PACKAGE NAME SEVERITY
CVE-2021-36159 apk-tools CRITICAL
CVE-2022-28391 busybox CRITICAL
CVE-2021-42378 busybox HIGH
CVE-2021-42379 busybox HIGH
CVE-2021-42380 busybox HIGH
CVE-2021-42383 ssl_client HIGH
CVE-2021-42384 ssl_client HIGH
CVE-2021-42385 ssl_client HIGH
CVE-2021-42386 ssl_client HIGH
CVE-2018-25032 zlib HIGH
CVE-2021-3121 github.com/gogo/protobuf HIGH
CVE-2020-27813 github.com/gorilla/websocket HIGH
CVE-2019-20933 github.com/influxdata/influxdb CRITICAL
CVE-2020-14040 golang.org/x/text HIGH
CVE-2021-3121 github.com/gogo/protobuf HIGH
CVE-2020-27813 github.com/gorilla/websocket HIGH
CVE-2019-20933 github.com/influxdata/influxdb CRITICAL
CVE-2020-14040 golang.org/x/text HIGH
@petermetz petermetz added Quorum dependencies Pull requests that update a dependency file Security Related to existing or potential security vulnerabilities P4 Priority 4: Low labels Jun 2, 2022
@petermetz
Copy link
Contributor

Marking as P4 because the Quorum AIO image is not meant to be used in production.

@aldousalvarez
Copy link
Contributor

Hi @petermetz Can you assign me on this one? Thank you so much!

aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Dec 23, 2022
@aldousalvarez
fix(security): vulnerabilities found in quorum-all-in-one
c6e6534 
Fixes hyperledger-cacti#2059

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
@aldousalvarez aldousalvarez mentioned this issue Dec 23, 2022
Merged
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Jan 3, 2023
@aldousalvarez
fix(security): vulnerabilities found in quorum-all-in-one
684a020 
Fixes hyperledger-cacti#2059

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Jan 4, 2023
@aldousalvarez
fix(security): vulnerabilities found in quorum-all-in-one
df939f5 
Fixes hyperledger-cacti#2059

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Jan 5, 2023
@aldousalvarez
fix(security): vulnerabilities found in quorum-all-in-one
f622149 
Fixes hyperledger-cacti#2059

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Jan 5, 2023
@aldousalvarez
fix(security): vulnerabilities found in quorum-all-in-one
1b92e95 
Fixes hyperledger-cacti#2059

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Jan 5, 2023
@aldousalvarez
fix(security): vulnerabilities found in quorum-all-in-one
4af9ed7 
Fixes hyperledger-cacti#2059

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Jan 6, 2023
@aldousalvarez
fix(security): vulnerabilities found in quorum-all-in-one
f47a286 
Fixes hyperledger-cacti#2059

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Jan 6, 2023
@aldousalvarez
fix(security): vulnerabilities found in quorum-all-in-one
fc2b35f 
Fixes hyperledger-cacti#2059

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
aldousalvarez added a commit to aldousalvarez/cactus that referenced this issue Feb 1, 2023
@aldousalvarez
fix(security): vulnerabilities found in quorum-all-in-one
59ed0fe 
Fixes hyperledger-cacti#2059

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
petermetz pushed a commit to aldousalvarez/cactus that referenced this issue Mar 27, 2023
@aldousalvarez @petermetz
fix(security): vulnerabilities found in quorum-all-in-one
77bddb7 
Fixes hyperledger-cacti#2059

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
@petermetz petermetz changed the title fix(security): vulnerabilities found in quorum-all-in-one fix(tools/quorum-all-in-one): address CVE-2021-36159 and CVE-2022-28391 Apr 6, 2023
sandeepnRES pushed a commit to sandeepnRES/cacti that referenced this issue Apr 10, 2023
@aldousalvarez @sandeepnRES
fix(tools/quorum-all-in-one): address CVE-2021-36159 and CVE-2022-28391
ab3a118 
Other, lower severity vulnerabilities are also being addressed by this
change but the two big ones are the critical severity ones mentioned
in the commit subject.

Most of the vulnerabilities are now fixed in quorum-all-in-one but
there are still some that are not because most of the remaining
vulnerabilities are still new and is still waiting for the new changes
to be pulled in and released on their respective package versions.

And we tried to ask on the quorum discussions on github as you can
see here. (Consensys/quorum#1513).

Here are the remaining vulnerabilities for quorum-all-in-one:
CVE-2022-3602
CVE-2022-3786
CVE-2022-3602
CVE-2022-3786
CVE-2022-42003
CVE-2022-42004
CVE-2022-45868
CVE-2022-1471
CVE-2022-21698
CVE-2022-27664
CVE-2022-32149
CVE-2022-21698
CVE-2022-27664
CVE-2022-32149

Fixes hyperledger-cacti#2059

Signed-off-by: aldousalvarez <aldousss.alvarez@gmail.com>
Signed-off-by: Peter Somogyvari <peter.somogyvari@accenture.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file P4 Priority 4: Low Quorum Security Related to existing or potential security vulnerabilities
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(tools/quorum-all-in-one): address CVE-2021-36159 and CVE-2022-28391 aldousalvarez/cactus
3 participants
@petermetz @zondervancalvez @aldousalvarez