[ https://issues.apache.org/jira/browse/GEODE-10236?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17522437#comment-17522437 ]
Bill Burcham edited comment on GEODE-10236 at 4/14/22 5:34 PM: --------------------------------------------------------------- I agree with [~abaker] . If you want to see the JGroups protocol stack used in Geode (membership) communication it's primarily here: [https://github.com/apache/geode/blob/develop/geode-membership/src/main/resources/org/apache/geode/distributed/internal/membership/gms/messenger/jgroups-config.xml] There is also a multicast protocol stack here: [https://github.com/apache/geode/blob/develop/geode-membership/src/main/resources/org/apache/geode/distributed/internal/membership/gms/messenger/jgroups-mcast.xml] Neither mentions the deprecated ENCRYPT protocol/layer or the AUTH protocol/layer. was (Author: bburcham): I agree with [~abaker] . If you want to see the JGroups protocol stack use in Geode (membership) communication it's primarily here: [https://github.com/apache/geode/blob/develop/geode-membership/src/main/resources/org/apache/geode/distributed/internal/membership/gms/messenger/jgroups-config.xml] There is also a multicast protocol stack here: [https://github.com/apache/geode/blob/develop/geode-membership/src/main/resources/org/apache/geode/distributed/internal/membership/gms/messenger/jgroups-mcast.xml] Neither mentions the deprecated ENCRYPT protocol/layer or the AUTH protocol/layer. > Compatibility issues while upgrading Jgroups to versions 4.0+ > ------------------------------------------------------------- > > Key: GEODE-10236 > URL: https://issues.apache.org/jira/browse/GEODE-10236 > Project: Geode > Issue Type: Bug > Affects Versions: 1.14.4 > Reporter: Rohan Jagtap > Priority: Major > Labels: needsTriage > > According to a recent CVE: > {quote}CVE-2016-2141 > NVD: 2016/06/30 - CVSS v2 Base Score: 7.5 - CVSS v3.1 Base Score: 9.8 > JGroups before 4.0 does not require the proper headers for the ENCRYPT and > AUTH protocols from nodes joining the cluster, which allows remote attackers > to bypass security restrictions and send and receive messages within the > cluster via unspecified vectors. > > {quote} > Hence we intend to upgrade jgroups to a recommended version. > However, even the latest version of apache geode ([geode-core > 1.14.4|https://mvnrepository.com/artifact/org.apache.geode/geode-core/1.14.4]) > uses jgroups 3.6.14 which has the aforementioned vulnerability. > Overriding the jgroups dependency to anything over 4.0+ gives the following > issue on running: > {{Caused by: org.springframework.beans.factory.BeanCreationException: Error > creating bean with name 'gemfireCache': FactoryBean threw exception on object > creation; nested exception is java.lang.ExceptionInInitializerError}} > {{ at > org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:176)}} > {{ at > org.springframework.beans.factory.support.FactoryBeanRegistrySupport.getObjectFromFactoryBean(FactoryBeanRegistrySupport.java:101)}} > {{ at > org.springframework.beans.factory.support.AbstractBeanFactory.getObjectForBeanInstance(AbstractBeanFactory.java:1828)}} > {{ at > org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.getObjectForBeanInstance(AbstractAutowireCapableBeanFactory.java:1265)}} > {{ at > org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:334)}} > {{ at > org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)}} > {{ at > org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:330)}} > {{ ... 32 common frames omitted}} > {{Caused by: java.lang.ExceptionInInitializerError: null}} > {{ at > org.apache.geode.distributed.internal.membership.gms.Services.<init>(Services.java:155)}} > {{ at > org.apache.geode.distributed.internal.membership.gms.MembershipBuilderImpl.create(MembershipBuilderImpl.java:114)}} > {{ at > org.apache.geode.distributed.internal.DistributionImpl.<init>(DistributionImpl.java:150)}} > {{ at > org.apache.geode.distributed.internal.DistributionImpl.createDistribution(DistributionImpl.java:217)}} > {{ at > org.apache.geode.distributed.internal.ClusterDistributionManager.<init>(ClusterDistributionManager.java:464)}} > {{ at > org.apache.geode.distributed.internal.ClusterDistributionManager.<init>(ClusterDistributionManager.java:497)}} > {{ at > org.apache.geode.distributed.internal.ClusterDistributionManager.create(ClusterDistributionManager.java:326)}} > {{ at > org.apache.geode.distributed.internal.InternalDistributedSystem.initialize(InternalDistributedSystem.java:779)}} > {{ at > org.apache.geode.distributed.internal.InternalDistributedSystem.access$200(InternalDistributedSystem.java:135)}} > {{ at > org.apache.geode.distributed.internal.InternalDistributedSystem$Builder.build(InternalDistributedSystem.java:3036)}} > {{ at > org.apache.geode.distributed.internal.InternalDistributedSystem.connectInternal(InternalDistributedSystem.java:290)}} > {{ at > org.apache.geode.distributed.internal.InternalDistributedSystem.connectInternal(InternalDistributedSystem.java:216)}} > {{ at > org.apache.geode.internal.cache.InternalCacheBuilder.createInternalDistributedSystem(InternalCacheBuilder.java:346)}} > {{ at java.base/java.util.Optional.orElseGet(Optional.java:369)}} > {{ at > org.apache.geode.internal.cache.InternalCacheBuilder.create(InternalCacheBuilder.java:157)}} > {{ at > org.apache.geode.cache.CacheFactory.create(CacheFactory.java:142)}} > {{ at > org.springframework.data.gemfire.CacheFactoryBean.createCache(CacheFactoryBean.java:472)}} > {{ at > org.springframework.data.gemfire.CacheFactoryBean.resolveCache(CacheFactoryBean.java:326)}} > {{ at > org.springframework.data.gemfire.CacheFactoryBean.init(CacheFactoryBean.java:270)}} > {{ at java.base/java.util.Optional.orElseGet(Optional.java:369)}} > {{ at > org.springframework.data.gemfire.CacheFactoryBean.getObject(CacheFactoryBean.java:802)}} > {{ at > org.springframework.data.gemfire.CacheFactoryBean.getObject(CacheFactoryBean.java:110)}} > {{ at > org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:169)}} > {{ ... 38 common frames omitted}} > {{Caused by: java.lang.IllegalStateException: JGAddress.create() returned the > wrong class: UUID}}{{ at > org.jgroups.conf.ClassConfigurator.add(ClassConfigurator.java:101)}} > {{ at > org.apache.geode.distributed.internal.membership.gms.messenger.JGroupsMessenger.<clinit>(JGroupsMessenger.java:164)}} > {{ ... 61 common frames omitted}} -- This message was sent by Atlassian Jira (v8.20.1#820001)