ONAP Vulnerability Management for Ela Alto release components

ONAP Vulnerability Management for Ela Alto release – components upgrades proposals Pawel Pawlak May 30 th, 2019

Introduction • Known vulnerabilities management process deployed since Beijing release with Nexus-IQ. • Projects usually do not put effort on repositories upgrades or replacement alternatives, but some good examples exist e. g. CLAMP and json replacement with gson. • Following 4 th iteration of known vulnerabilities analysis we would liek to propose to ONAP community following upgrades for El Alto release – preferable at M 0 o M 1 gate. • Direct/indirect interdependencies to be further investigated with projects. • Priorities: - 1: most important to fix; affects at least 7 projects - 2: second group to fix; affects 4 -6 projects - 3: third group to fix; affects 1 -3 projects 2

Conclusions and proposals 1/4 L. p. Component name Recommended version Impacted projects Priority 1 dom 4 j 2. 1. 1 VID, UUI, SO, SDNC, SDC, Portal, Policy, Logging , DCAE, CCSDK, APPC, DMaa. P 1 2 bootstrap. min. js 4. 3. 1 3 bootstrap 4. 1. 2 (maybe 4. 3. 1) SDNC, Policy 3 4 tomcat-embed-core 8. 5. 32 (8. 5. 41, 9. 0. 20 most recent versions) SO, SDNC, Logging, CCSDK 2 5 spring-core 4. 3. 18 (from spring framework website: 5. 1. x is the latest and recommended line, supported until the end of 2019 (to be superseded by the longer-lived 5. 2. x in July 2019); 4. 3. 24 is latest version of the 4. 3 line). SDNC, CCSDK 3 6 spring-expression 4. 3. 18 (latest versions: 4. 3. 24, 5. 0. 14, 5. 1. 7) SDNC, CCSDK 2 7 spring-web 4. 3. 18 (latest version 4. 3. 24, 5. 0. 14, 5. 1. 7) SO, SDC, DMaa. P, DCAE, SDNC, CCSDK 2 8 spring-webmvc 4. 3. 18 (latest version 4. 3. 24, 5. 0. 14, 5. 1. 7) SDNC 3 9 spring-data-commons 1. 13. 12 SDNC 3 3

Conclusions and proposals 2/4 L. p. Component name Recommended version Impacted projects Priority 12 spring-security-web 4. 2. 9/5. 1. 0 DMaa. P 3 13 spring-boot 2. 1. 3 (maybe 2. 1. 5) 14 spring-security-oauth 2 2. 3. 5 (maybe 2. 3. 6) 15 j. Query 3. 0. 0 (maybe 3. 4. 1, there is a jquery migrate plugin) SDNC, CCSDK 3 16 guava 23. 6. 1 (maybe 27. 1) DCAE, APPC, AAI 3 17 jetty-http 9. 4. 12 (maybe 9. 4. 18) VNFSDK 3 18 jetty-server 9. 4. 16. v 20190411 (maybe 9. 4. 18 v 20190429) SDNC, Multicloud, Logging, DCAE, AAF 2 19 jetty-util 9. 4. 17. v 20190418 (maybe 9. 4. 18 v 20190429) SDNC, Multicloud, Logging, DCAE, AAF 2 4

Conclusions and proposals 3/4 L. p. Component name Recommended version Impacted projects Priority 20 commons-codec 1. 13 (latest version on the commons-codec repo is 1. 12) VID, VFC, UUI, SO, SDC, Portal, Multicloud, Logging, HOLMES, DMaa. P, DCAE, CCSDK, APPC, AAI, AAF 1 19 commons-fileupload 1. 4 VID, SO, SDC, Portal, Policy, DMaa. P, CCSDK, AAI 1 20 commons-beanutils 1. 9. 3 VFC, MSB 3 commons-collections 3. 2. 2 (maybe 4. 3) VFC, SO, SDC, MSB, CCSDK, DMaa. P 2 21 Javax. servlet-api VNFSDK, VID, VFC, UUI, SO, 1 SDNC, SDC, Portal, Policy, Music, MSB, Logging, , Holmes, DMaa. P, DCAE, CCSDK, APPC, AAI, AAF 5

Conclusions and proposals 4/4 L. p. Component name Recommended version Impacted projects Priority 22 handlebars 4. 0. 14/4. 1. 2? SDC, SDNC, MUSIC, Logging, CCSDK 2 23 logback-classic 1. 3. x are all alpha VFC, SDNC, SDC, Logging, CCSDK, AAI 2 24 jackson-databind None SDNC, Logging, CCSDK, APPC 2 25 jackson-datatype-jsr 310 26 apache. karaf. jaas SDNC, CCSDK 3 27 jackson-mapper-asl 28 apache. karaf. util SDNC, CCSDK 3 29 apache. karaf. shell. core SDNC, CCSDK 3 30 swagger-ui SDC 3 None 2. 1. 4 6

Thank you