[ https://issues.apache.org/jira/browse/GEODE-10236?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Anthony Baker resolved GEODE-10236. ----------------------------------- Resolution: Not A Bug Please see [1]. Geode uses jgroups for reliable UDP transport. The vulnerability exists only for AUTH / ENCRYPT which Geode does not use. This is not a security issue. I realize that it can be hard when scanners generate false positives like this. However, upgrading to a new major version of JGroups is a large effort and may break Geode guarantees like rolling upgrades. I think it's more likely that we would invest in building a different transport layer for membership messages so that we can control breaking changes introduced by jgroups. [1] https://lists.apache.org/thread/ymj65x43g2k1ozdckkr92tt8rysrn8wd > Compatibility issues while upgrading Jgroups to versions 4.0+ > ------------------------------------------------------------- > > Key: GEODE-10236 > URL: https://issues.apache.org/jira/browse/GEODE-10236 > Project: Geode > Issue Type: Bug > Affects Versions: 1.14.4 > Reporter: Rohan Jagtap > Priority: Major > Labels: needsTriage > > According to a recent CVE: > {quote}CVE-2016-2141 > NVD: 2016/06/30 - CVSS v2 Base Score: 7.5 - CVSS v3.1 Base Score: 9.8 > JGroups before 4.0 does not require the proper headers for the ENCRYPT and > AUTH protocols from nodes joining the cluster, which allows remote attackers > to bypass security restrictions and send and receive messages within the > cluster via unspecified vectors. > > {quote} > Hence we intend to upgrade jgroups to a recommended version. > However, even the latest version of apache geode ([geode-core > 1.14.4|https://mvnrepository.com/artifact/org.apache.geode/geode-core/1.14.4]) > uses jgroups 3.6.14 which has the aforementioned vulnerability. > Overriding the jgroups dependency to anything over 4.0+ gives the following > issue on running: > {{Caused by: org.springframework.beans.factory.BeanCreationException: Error > creating bean with name 'gemfireCache': FactoryBean threw exception on object > creation; nested exception is java.lang.ExceptionInInitializerError}} > {{ at > org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:176)}} > {{ at > org.springframework.beans.factory.support.FactoryBeanRegistrySupport.getObjectFromFactoryBean(FactoryBeanRegistrySupport.java:101)}} > {{ at > org.springframework.beans.factory.support.AbstractBeanFactory.getObjectForBeanInstance(AbstractBeanFactory.java:1828)}} > {{ at > org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.getObjectForBeanInstance(AbstractAutowireCapableBeanFactory.java:1265)}} > {{ at > org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:334)}} > {{ at > org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)}} > {{ at > org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:330)}} > {{ ... 32 common frames omitted}} > {{Caused by: java.lang.ExceptionInInitializerError: null}} > {{ at > org.apache.geode.distributed.internal.membership.gms.Services.<init>(Services.java:155)}} > {{ at > org.apache.geode.distributed.internal.membership.gms.MembershipBuilderImpl.create(MembershipBuilderImpl.java:114)}} > {{ at > org.apache.geode.distributed.internal.DistributionImpl.<init>(DistributionImpl.java:150)}} > {{ at > org.apache.geode.distributed.internal.DistributionImpl.createDistribution(DistributionImpl.java:217)}} > {{ at > org.apache.geode.distributed.internal.ClusterDistributionManager.<init>(ClusterDistributionManager.java:464)}} > {{ at > org.apache.geode.distributed.internal.ClusterDistributionManager.<init>(ClusterDistributionManager.java:497)}} > {{ at > org.apache.geode.distributed.internal.ClusterDistributionManager.create(ClusterDistributionManager.java:326)}} > {{ at > org.apache.geode.distributed.internal.InternalDistributedSystem.initialize(InternalDistributedSystem.java:779)}} > {{ at > org.apache.geode.distributed.internal.InternalDistributedSystem.access$200(InternalDistributedSystem.java:135)}} > {{ at > org.apache.geode.distributed.internal.InternalDistributedSystem$Builder.build(InternalDistributedSystem.java:3036)}} > {{ at > org.apache.geode.distributed.internal.InternalDistributedSystem.connectInternal(InternalDistributedSystem.java:290)}} > {{ at > org.apache.geode.distributed.internal.InternalDistributedSystem.connectInternal(InternalDistributedSystem.java:216)}} > {{ at > org.apache.geode.internal.cache.InternalCacheBuilder.createInternalDistributedSystem(InternalCacheBuilder.java:346)}} > {{ at java.base/java.util.Optional.orElseGet(Optional.java:369)}} > {{ at > org.apache.geode.internal.cache.InternalCacheBuilder.create(InternalCacheBuilder.java:157)}} > {{ at > org.apache.geode.cache.CacheFactory.create(CacheFactory.java:142)}} > {{ at > org.springframework.data.gemfire.CacheFactoryBean.createCache(CacheFactoryBean.java:472)}} > {{ at > org.springframework.data.gemfire.CacheFactoryBean.resolveCache(CacheFactoryBean.java:326)}} > {{ at > org.springframework.data.gemfire.CacheFactoryBean.init(CacheFactoryBean.java:270)}} > {{ at java.base/java.util.Optional.orElseGet(Optional.java:369)}} > {{ at > org.springframework.data.gemfire.CacheFactoryBean.getObject(CacheFactoryBean.java:802)}} > {{ at > org.springframework.data.gemfire.CacheFactoryBean.getObject(CacheFactoryBean.java:110)}} > {{ at > org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:169)}} > {{ ... 38 common frames omitted}} > {{Caused by: java.lang.IllegalStateException: JGAddress.create() returned the > wrong class: UUID}}{{ at > org.jgroups.conf.ClassConfigurator.add(ClassConfigurator.java:101)}} > {{ at > org.apache.geode.distributed.internal.membership.gms.messenger.JGroupsMessenger.<clinit>(JGroupsMessenger.java:164)}} > {{ ... 61 common frames omitted}} -- This message was sent by Atlassian Jira (v8.20.1#820001)