Hey Alexis, Reminder that we have a security response team that's meant to handle these types of things. Stephen is on the security response team, but you might still be better off sharing with that group vs Stephen and Michael directly. We asked for these details to be sent to that list months ago when ONAP folks first mentioned these scanning issues, but last time I talked to Stephen about it they still hadn't been sent.
secur...@lists.opendaylight.org We appreciate ONAP working with us to make sure we're the best upstream we can be. Looking forward to benefiting both projects by working together more closely. Daniel On Fri, Dec 7, 2018 at 8:16 PM Alexis de Talhouët <adetalhoue...@gmail.com> wrote: > Michael, Stephen, > > I sent you the information privately, as we should not share > vulnerabilities publicly. > Please only distribute internally to PTL and/or TSC. > > Regards, > Alexis > > On Dec 6, 2018, at 2:20 PM, Abhijit Kumbhare <abhijitk...@gmail.com> > wrote: > > Thanks Alexis, Stephen and Michael. > > On Thu, Dec 6, 2018 at 10:16 AM Alexis de Talhouët < > adetalhoue...@gmail.com> wrote: > >> Michael, Stephen, >> >> Thank you for prompt response. I’ll get clarification on the >> vulnerabilities we have identified and will come back to you on the points >> you mentioned. >> >> Alexis >> >> > On Dec 6, 2018, at 1:06 PM, Stephen Kitt <sk...@redhat.com> wrote: >> > >> > Hi Alexis, >> > >> > On Thu, 6 Dec 2018 17:57:29 +0100 >> > Michael Vorburger <vorbur...@redhat.com> wrote: >> >>> On Dec 6, 2018, at 11:05 AM, Alexis de Talhouët >> >>> <adetalhoue...@gmail.com> wrote: >> >>> >> >>> Greeting ODL community, TSC, >> >>> >> >>> Within the ONAP community, we’re seeking CII badging. For that, we >> >>> need to eradicate critical vulnerabilities. >> >>> >> >>> Few ONAP projects are depending on OpenDaylight artifacts, such as >> >>> CCSDK, and we’re seeing a fair amount of vulnerabilities coming >> >>> from OpenDaylight; precisely, 130 vulnerabilities in our CCSDK CLM >> >>> reports that were found in the ODL Oxygen SR3 distribution, >> >>> documented here >> >>> https://wiki.onap.org/pages/viewpage.action?pageId=45300857. The >> >>> document is high level information providing only the groupId of >> >>> the maven artifact. I don’t have permission to see ODL projects in >> >>> LF Nexus-ID: https://nexus-iq.wl.linuxfoundation.org, so I can't >> >>> link directly reports here. >> >>> >> >>> Point is, we would like to know where ODL stands with regards to CII >> >>> Badging; is that something you’re seeking? >> > >> > Not actively, but we do care about fixing vulnerabilities. >> > >> >>> Regardless, we would like to know if ODL is willing to address >> >>> critical vulnerabilities impacting ONAP? >> > >> > Yes, we are. >> > >> >> I just had a (quick) look at wiki.onap.org, and was wondering if you >> >> guys would be willing to help us help you more, by: >> >> >> >> - clarifying details about the vulnerability, like a link to a CVE >> > >> > +1 >> > >> >> - first check out Fluorine or even better already Neon; at least some >> >> of the Karaf related ones likely are already solved >> > >> > At least, check Oxygen SR4 when it’s available. I’m also not entirely >> > sure how the analysis matches up with Oxygen SR3; for example, the >> > version of Guava in SR3 is 23.6.1, which fixes the known >> > vulnerabilities. CLM also flags a number of false positives, e.g. >> > commons-fileupload (1.3.3 in SR3) which is fixed AFAIK. >> > >> >> - clarify where you found the artifact... there are (to me) some >> >> surprises in your list; e.g. sendgrid or angular I wouldn't know >> >> where that is used by what project in ODL >> > >> > +1 >> > >> >> - dedupe your list - it looks a lot longer than it really is, many >> >> dupes ;) >> > >> > I think this is because the artifacts aren’t fully described: we need >> > the artifactId as well as the groupId, and ideally the version. >> > >> > Regards, >> > >> > Stephen >> >> _______________________________________________ >> TSC mailing list >> t...@lists.opendaylight.org >> https://lists.opendaylight.org/mailman/listinfo/tsc >> > > _______________________________________________ > TSC mailing list > t...@lists.opendaylight.org > https://lists.opendaylight.org/mailman/listinfo/tsc > -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#4282): https://lists.onap.org/g/onap-tsc/message/4282 Mute This Topic: https://lists.onap.org/mt/28628360/21656 Group Owner: onap-tsc+ow...@lists.onap.org Unsubscribe: https://lists.onap.org/g/onap-tsc/leave/2743226/1412191262/xyzzy [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
