Giter Club home page Giter Club logo

appdevgbb / reddog-code-spring Goto Github PK

View Code? Open in Web Editor NEW
8.0 5.0 8.0 6.19 MB

MOVED. Sample repo to showcase Azure hosting options for Spring workloads, including usage of Azure Java SDKs to integrate with our managed services

Home Page: https://github.com/Azure/reddog-solutions

Java 79.63% Dockerfile 4.40% JavaScript 0.12% Shell 6.42% Bicep 7.74% Python 1.69%
azure-redis-cache azure-spring-apps cosmosdb event-hubs java kafka azure-openai gpt-3-prompts microservices openai

reddog-code-spring's Introduction

reddog-code-spring (moved)

⚠️ MOVED to reddog-solutions

Background

This repo, based on reddog-code, is a deep-dive for Java/Spring developers on Azure hosting options and idiomatic java sdks that integrate with managed backing services. Using a retail scenario that depicts a typical event-driven microservices architecture, this codebase (and associated lab) will ease the migration and modernization of Java workloads on Azure. This repo also highlights usage of our emergent services such as Az Cognitive Services, OpenAI, and HuggingFace to transform enterprise applications with Azure AI offerings. In addition, with code, it shows usage of our offerings in preview such as the latest JFR for Application Insights that uses Machine Learning for insightful performance diagnostics, passwordless connections to services using managed identities, and JMS 2.0 API with Azure Service Bus.

Setup:

Jump over to the docs to get started.

Initial setup docs

Related repos

Services and local port mappings

Service Description Key dependencies port
Virtual Customer Simulates orders webflux, jobrunr, faker, 8701
Order Service Place and manage orders flyway, eh-kafka, jpa 8702
Loyalty Service Manage reward points redis, eh-kafka, jpa 8703
Makeline Service Fulfil order queue cosmodb, eh-kafka, jpa 8704
Receipt generation Archive receipts blob storage 8705
Virtual Worker Simulate order completion cosmodb 8706
Accounting Service Process and transform data cosmodb, eh-kafka, jpa 8707
nn-bindings GPT-3 responses to prompts az-openai, python 8000
local eureka server Service discovery eureka 8761
local config server Centralized Configurations spring cloud config 8088
local gateway server Gateway spring cloud gateway 8080

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

⚠️ 🚧 Java version of reddog-code for Azure Spring Apps (ASA) and App Service is WIP

reddog-code-spring's People

Contributors

agoncal avatar chzbrgr71 avatar jschluchter avatar mend-bolt-for-github[bot] avatar thegovind avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar

reddog-code-spring's Issues

Singular or plural package names?

"Naming things is hard"... and naming packages is even harder ;o)

The project uses a mixture of singular and plural for the package names:

  • Singular: controller, dto, exception, mapper, service
  • Plural: repositories, entities

I wonder if repositories and entities could be renamed to singular (repository and entity) for naming convention ?

spring-cloud-starter-netflix-eureka-client-3.1.3.jar: 3 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - spring-cloud-starter-netflix-eureka-client-3.1.3.jar

Path to dependency file: /order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/19.0/guava-19.0.jar

Found in HEAD commit: 12a4b7104aee6dc1d73a1067f97be38f11bc076a

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2021-43859 High 7.5 xstream-1.4.18.jar Transitive N/A
CVE-2018-10237 Medium 5.9 guava-19.0.jar Transitive N/A
CVE-2020-8908 Low 3.3 guava-19.0.jar Transitive N/A

Details

CVE-2021-43859

Vulnerable Library - xstream-1.4.18.jar

Library home page: http://x-stream.github.io

Path to dependency file: /order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/thoughtworks/xstream/xstream/1.4.18/xstream-1.4.18.jar

Dependency Hierarchy:

  • spring-cloud-starter-netflix-eureka-client-3.1.3.jar (Root Library)
    • eureka-client-1.10.17.jar
      • xstream-1.4.18.jar (Vulnerable Library)

Found in HEAD commit: 12a4b7104aee6dc1d73a1067f97be38f11bc076a

Found in base branch: main

Vulnerability Details

XStream is an open source java library to serialize objects to XML and back again. Versions prior to 1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible. Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for further details on a workaround if an upgrade is not possible.

Publish Date: 2022-02-01

URL: CVE-2021-43859

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rmr5-cpv2-vgjf

Release Date: 2022-02-01

Fix Resolution: com.thoughtworks.xstream:xstream:1.4.19

Step up your Open Source Security Game with Mend here

CVE-2018-10237

Vulnerable Library - guava-19.0.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: https://github.com/google/guava

Path to dependency file: /order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/19.0/guava-19.0.jar

Dependency Hierarchy:

  • spring-cloud-starter-netflix-eureka-client-3.1.3.jar (Root Library)
    • eureka-client-1.10.17.jar
      • servo-core-0.12.21.jar
        • guava-19.0.jar (Vulnerable Library)

Found in HEAD commit: 12a4b7104aee6dc1d73a1067f97be38f11bc076a

Found in base branch: main

Vulnerability Details

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Publish Date: 2018-04-26

URL: CVE-2018-10237

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-10237

Release Date: 2018-04-26

Fix Resolution: 24.1.1-jre, 24.1.1-android

Step up your Open Source Security Game with Mend here

CVE-2020-8908

Vulnerable Library - guava-19.0.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: https://github.com/google/guava

Path to dependency file: /order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/google/guava/guava/19.0/guava-19.0.jar

Dependency Hierarchy:

  • spring-cloud-starter-netflix-eureka-client-3.1.3.jar (Root Library)
    • eureka-client-1.10.17.jar
      • servo-core-0.12.21.jar
        • guava-19.0.jar (Vulnerable Library)

Found in HEAD commit: 12a4b7104aee6dc1d73a1067f97be38f11bc076a

Found in base branch: main

Vulnerability Details

A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been marked @deprecated in versions 30.0 and later and should not be used. For Android developers, we recommend choosing a temporary directory API provided by Android, such as context.getCacheDir(). For other Java developers, we recommend migrating to the Java 7 API java.nio.file.Files.createTempDirectory() which explicitly configures permissions of 700, or configuring the Java runtime's java.io.tmpdir system property to point to a location whose permissions are appropriately configured.

Publish Date: 2020-12-10

URL: CVE-2020-8908

CVSS 3 Score Details (3.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908

Release Date: 2020-12-10

Fix Resolution: v30.0

Step up your Open Source Security Game with Mend here

spring-boot-starter-actuator-2.7.2-SNAPSHOT.jar: 5 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - spring-boot-starter-actuator-2.7.2-SNAPSHOT.jar

Path to dependency file: /receipt-generation-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar,/home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar

Found in HEAD commit: 12a4b7104aee6dc1d73a1067f97be38f11bc076a

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2022-25857 High 7.5 snakeyaml-1.30.jar Transitive N/A
CVE-2022-38749 Medium 6.5 snakeyaml-1.30.jar Transitive N/A
CVE-2022-38752 Medium 6.5 snakeyaml-1.30.jar Transitive N/A
CVE-2022-38751 Medium 6.5 snakeyaml-1.30.jar Transitive N/A
CVE-2022-38750 Medium 6.5 snakeyaml-1.30.jar Transitive N/A

Details

CVE-2022-25857

Vulnerable Library - snakeyaml-1.30.jar

YAML 1.1 parser and emitter for Java

Library home page: https://bitbucket.org/snakeyaml/snakeyaml

Path to dependency file: /receipt-generation-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar,/home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar

Dependency Hierarchy:

  • spring-boot-starter-actuator-2.7.2-SNAPSHOT.jar (Root Library)
    • spring-boot-starter-2.7.2-SNAPSHOT.jar
      • snakeyaml-1.30.jar (Vulnerable Library)

Found in HEAD commit: 12a4b7104aee6dc1d73a1067f97be38f11bc076a

Found in base branch: main

Vulnerability Details

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

Publish Date: 2022-08-30

URL: CVE-2022-25857

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25857

Release Date: 2022-08-30

Fix Resolution: org.yaml:snakeyaml:1.31

Step up your Open Source Security Game with Mend here

CVE-2022-38749

Vulnerable Library - snakeyaml-1.30.jar

YAML 1.1 parser and emitter for Java

Library home page: https://bitbucket.org/snakeyaml/snakeyaml

Path to dependency file: /receipt-generation-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar,/home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar

Dependency Hierarchy:

  • spring-boot-starter-actuator-2.7.2-SNAPSHOT.jar (Root Library)
    • spring-boot-starter-2.7.2-SNAPSHOT.jar
      • snakeyaml-1.30.jar (Vulnerable Library)

Found in HEAD commit: 12a4b7104aee6dc1d73a1067f97be38f11bc076a

Found in base branch: main

Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Publish Date: 2022-09-05

URL: CVE-2022-38749

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/525/got-stackoverflowerror-for-many-open

Release Date: 2022-09-05

Fix Resolution: org.yaml:snakeyaml:1.31

Step up your Open Source Security Game with Mend here

CVE-2022-38752

Vulnerable Library - snakeyaml-1.30.jar

YAML 1.1 parser and emitter for Java

Library home page: https://bitbucket.org/snakeyaml/snakeyaml

Path to dependency file: /receipt-generation-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar,/home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar

Dependency Hierarchy:

  • spring-boot-starter-actuator-2.7.2-SNAPSHOT.jar (Root Library)
    • spring-boot-starter-2.7.2-SNAPSHOT.jar
      • snakeyaml-1.30.jar (Vulnerable Library)

Found in HEAD commit: 12a4b7104aee6dc1d73a1067f97be38f11bc076a

Found in base branch: main

Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.

Publish Date: 2022-09-05

URL: CVE-2022-38752

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2022-38751

Vulnerable Library - snakeyaml-1.30.jar

YAML 1.1 parser and emitter for Java

Library home page: https://bitbucket.org/snakeyaml/snakeyaml

Path to dependency file: /receipt-generation-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar,/home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar

Dependency Hierarchy:

  • spring-boot-starter-actuator-2.7.2-SNAPSHOT.jar (Root Library)
    • spring-boot-starter-2.7.2-SNAPSHOT.jar
      • snakeyaml-1.30.jar (Vulnerable Library)

Found in HEAD commit: 12a4b7104aee6dc1d73a1067f97be38f11bc076a

Found in base branch: main

Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Publish Date: 2022-09-05

URL: CVE-2022-38751

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2022-38750

Vulnerable Library - snakeyaml-1.30.jar

YAML 1.1 parser and emitter for Java

Library home page: https://bitbucket.org/snakeyaml/snakeyaml

Path to dependency file: /receipt-generation-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar,/home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar

Dependency Hierarchy:

  • spring-boot-starter-actuator-2.7.2-SNAPSHOT.jar (Root Library)
    • spring-boot-starter-2.7.2-SNAPSHOT.jar
      • snakeyaml-1.30.jar (Vulnerable Library)

Found in HEAD commit: 12a4b7104aee6dc1d73a1067f97be38f11bc076a

Found in base branch: main

Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Publish Date: 2022-09-05

URL: CVE-2022-38750

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/525/got-stackoverflowerror-for-many-open

Release Date: 2022-09-05

Fix Resolution: org.yaml:snakeyaml:1.31

Step up your Open Source Security Game with Mend here

Azure OpenAI link to fix + specify supported Region

at https://github.com/appdevgbb/reddog-code-spring/tree/main/generative-ai/README.md the Link to Azure OpenAI returns 404, the correct link is : https://learn.microsoft.com/en-us/azure/cognitive-services/openai/

Also I suggest to add a link to the Regions supported as it is very limited for now, in EMEA I think only WestEurope (hero Region) is supported

More eaxactly the Region support list is mentioned in this table :

  • East US
  • South Central US
  • West Europe

@thegovind

spring-boot-starter-actuator-2.7.3.jar: 5 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - spring-boot-starter-actuator-2.7.3.jar

Path to dependency file: /order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2022-25857 High 7.5 snakeyaml-1.30.jar Transitive N/A
CVE-2022-38749 Medium 6.5 snakeyaml-1.30.jar Transitive N/A
CVE-2022-38752 Medium 6.5 snakeyaml-1.30.jar Transitive N/A
CVE-2022-38751 Medium 6.5 snakeyaml-1.30.jar Transitive N/A
CVE-2022-38750 Medium 6.5 snakeyaml-1.30.jar Transitive N/A

Details

CVE-2022-25857

Vulnerable Library - snakeyaml-1.30.jar

YAML 1.1 parser and emitter for Java

Library home page: https://bitbucket.org/snakeyaml/snakeyaml

Path to dependency file: /order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar

Dependency Hierarchy:

  • spring-boot-starter-actuator-2.7.3.jar (Root Library)
    • spring-boot-starter-2.7.3.jar
      • snakeyaml-1.30.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

Publish Date: 2022-08-30

URL: CVE-2022-25857

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25857

Release Date: 2022-08-30

Fix Resolution: org.yaml:snakeyaml:1.31

Step up your Open Source Security Game with Mend here

CVE-2022-38749

Vulnerable Library - snakeyaml-1.30.jar

YAML 1.1 parser and emitter for Java

Library home page: https://bitbucket.org/snakeyaml/snakeyaml

Path to dependency file: /order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar

Dependency Hierarchy:

  • spring-boot-starter-actuator-2.7.3.jar (Root Library)
    • spring-boot-starter-2.7.3.jar
      • snakeyaml-1.30.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Publish Date: 2022-09-05

URL: CVE-2022-38749

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/525/got-stackoverflowerror-for-many-open

Release Date: 2022-09-05

Fix Resolution: org.yaml:snakeyaml:1.31

Step up your Open Source Security Game with Mend here

CVE-2022-38752

Vulnerable Library - snakeyaml-1.30.jar

YAML 1.1 parser and emitter for Java

Library home page: https://bitbucket.org/snakeyaml/snakeyaml

Path to dependency file: /order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar

Dependency Hierarchy:

  • spring-boot-starter-actuator-2.7.3.jar (Root Library)
    • spring-boot-starter-2.7.3.jar
      • snakeyaml-1.30.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.

Publish Date: 2022-09-05

URL: CVE-2022-38752

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2022-38751

Vulnerable Library - snakeyaml-1.30.jar

YAML 1.1 parser and emitter for Java

Library home page: https://bitbucket.org/snakeyaml/snakeyaml

Path to dependency file: /order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar

Dependency Hierarchy:

  • spring-boot-starter-actuator-2.7.3.jar (Root Library)
    • spring-boot-starter-2.7.3.jar
      • snakeyaml-1.30.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Publish Date: 2022-09-05

URL: CVE-2022-38751

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2022-38750

Vulnerable Library - snakeyaml-1.30.jar

YAML 1.1 parser and emitter for Java

Library home page: https://bitbucket.org/snakeyaml/snakeyaml

Path to dependency file: /order-service/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/yaml/snakeyaml/1.30/snakeyaml-1.30.jar

Dependency Hierarchy:

  • spring-boot-starter-actuator-2.7.3.jar (Root Library)
    • spring-boot-starter-2.7.3.jar
      • snakeyaml-1.30.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.

Publish Date: 2022-09-05

URL: CVE-2022-38750

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bitbucket.org/snakeyaml/snakeyaml/issues/525/got-stackoverflowerror-for-many-open

Release Date: 2022-09-05

Fix Resolution: org.yaml:snakeyaml:1.31

Step up your Open Source Security Game with Mend here

What about changing default port numbers?

Today the application uses 808x port range:

Service port
Virtual Customer 8081
Order Service 8082
Loyalty Service 8083
Makeline Service 8084
Receipt generation 8085
Virtual Worker 8086
Accounting Service 8087

The problem is that these ports are quite common and used by other processes. If you look at the list of common ports, the range 870x is not used.

What about changing port numbers?

Service port
Virtual Customer 8701
Order Service 8702
Loyalty Service 8703
Makeline Service 8704
Receipt generation 8705
Virtual Worker 8706
Accounting Service 8707

Still using java.util.Date

Some DTOs (OrderSummaryDto, OrderSummary) still use java.util.Date. Shouldn't we use the java.time APIs?

loyalty-service and makeline-service fail due to Kafka

I've been following the instructions to get Red Dog up and running on my ASA instance. The order-service initially failed. I had to add SERVICEBUSCONNECTIONSTRING to the az spring app create command.

But now loyalty-service and makeline-service app deployments are failing and I am not unable to understand why. Below is the log output for the loyalty-service.

Thanks for any help on this

mike@LAPTOP-E5O4743B:/mnt/c/projects/reddog-code-spring$ az spring app logs -n $SERVICE_NAME -s $SPRING_CLUSTER -g $RG --lines 1000
Build in Environment Variables
BUILD_IN_EUREKA_CLIENT_SERVICEURL_DEFAULTZONE=https://asareddog27153mike11974.svc.azuremicroservices.io/eureka/eureka
BUILD_IN_SPRING_CLOUD_CONFIG_URI=https://asareddog27153mike11974.svc.azuremicroservices.io/config
BUILD_IN_SPRING_CLOUD_CONFIG_FAILFAST=true
[Azure Spring Cloud] The following environment variables are loaded: KAFKA_COMPLETED_ORDERS_TOPIC KAFKA_CONSUMER_GROUP_ID AZUREREDISHOST AZUREREDISACCESSKEY REQUIRED AZURESTORAGEACCOUNTNAME KAFKASASLMECHANISM AZURECOSMOSDBKEY MYSQLURL AZURECOSMOSDBDATABASENAME AZURECOSMOSDBURI MYSQLPASSWORD PASSWORD KAFKASECURITYPROTOCOL KAFKATOPICNAME AZURESTORAGEENDPOINT USERNAME KAFKASASLJAASCONFIG AZUREREDISPORT KAFKABOOTSTRAPSERVERS AZURESTORAGEACCOUNTKEY SERVICEBUSCONNECTIONSTRING KAFKATOPICGROUP MYSQLUSER 
Setting Active Processor Count to 16
Adding $JAVA_OPTS to $JAVA_TOOL_OPTIONS
Calculated JVM Memory Configuration: -XX:MaxDirectMemorySize=10M -Xmx392953K -XX:MaxMetaspaceSize=143622K -XX:ReservedCodeCacheSize=240M -Xss1M (Total Memory: 1G, Thread Count: 250, Loaded Class Count: 22943, Headroom: 0%)
Enabling Java Native Memory Tracking
Adding 127 container CA certificates to JVM truststore
Spring Cloud Bindings Enabled
Picked up JAVA_TOOL_OPTIONS: -Djava.security.properties=/layers/paketo-buildpacks_microsoft-openjdk/java-security-properties/java-security.properties -XX:+ExitOnOutOfMemoryError -XX:ActiveProcessorCount=16 -XX:InitialRAMPercentage=60.0 -XX:MaxRAMPercentage=60.0  -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.port=1099 -Dcom.sun.management.jmxremote.local.only=true -Dmanagement.endpoints.jmx.exposure.include=health,metrics -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false -Dspring.jmx.enabled=true -Dserver.tomcat.mbeanregistry.enabled=true -Dfile.encoding=UTF8 -Deureka.client.service-url.defaultZone=https://asareddog27153mike11974.svc.azuremicroservices.io/eureka/eureka -DCONFIG_SERVER_URL=https://asareddog27153mike11974.svc.azuremicroservices.io/config -Dspring.cloud.config.uri=https://asareddog27153mike11974.svc.azuremicroservices.io/config -Dspring.cloud.config.fail-fast=true -XX:MaxDirectMemorySize=10M -Xmx392953K -XX:MaxMetaspaceSize=143622K -XX:ReservedCodeCacheSize=240M -Xss1M -XX:+UnlockDiagnosticVMOptions -XX:NativeMemoryTracking=summary -XX:+PrintNMTStatistics -Dorg.springframework.cloud.bindings.boot.enable=true
 __     __   _  _   __   __    ____  _  _
(  )   /  \ ( \/ ) / _\ (  )  (_  _)( \/ )
/ (_/\(  O ) )  / /    \/ (_/\  )(   )  /
\____/ \__/ (__/  \_/\_/\____/ (__) (__/
 ____  ____  ____  _  _  __    ___  ____
/ ___)(  __)(  _ \/ )( \(  )  / __)(  __)
\___ \ ) _)  )   /\ \/ / )(  ( (__  ) _)
(____/(____)(__\_) \__/ (__)  \___)(____)

2023-02-03 02:45:21.744  INFO [loyalty-service,,] 1 --- [           main] c.m.g.r.l.LoyaltyServiceApplication      : Starting LoyaltyServiceApplication v0.0.1-SNAPSHOT using Java 17.0.4.1 on loyalty-service-default-15-868cdcc9c-mk6z4 with PID 1 (/workspace/BOOT-INF/classes started by cnb in /workspace)
2023-02-03 02:45:21.818  INFO [loyalty-service,,] 1 --- [           main] c.m.g.r.l.LoyaltyServiceApplication      : No active profile set, falling back to 1 default profile: "default"
2023-02-03 02:45:21.937  WARN [loyalty-service,,] 1 --- [           main] o.s.b.c.config.ConfigDataEnvironment     : Property 'spring.profiles' imported from location 'class path resource [application.yaml]' is invalid and should be replaced with 'spring.config.activate.on-profile' [origin: class path resource [application.yaml] - 56:13]
2023-02-03 02:45:24.840  INFO [loyalty-service,,] 1 --- [           main] .s.d.r.c.RepositoryConfigurationDelegate : Multiple Spring Data modules found, entering strict repository configuration mode
2023-02-03 02:45:24.843  INFO [loyalty-service,,] 1 --- [           main] .s.d.r.c.RepositoryConfigurationDelegate : Bootstrapping Spring Data Redis repositories in DEFAULT mode.
2023-02-03 02:45:24.921  INFO [loyalty-service,,] 1 --- [           main] .s.d.r.c.RepositoryConfigurationDelegate : Finished Spring Data repository scanning in 66 ms. Found 0 Redis repository interfaces.
2023-02-03 02:45:25.464  INFO [loyalty-service,,] 1 --- [           main] o.s.cloud.context.scope.GenericScope     : BeanFactory id=cdb1659e-e66b-3399-8209-0da12c40d8f3
2023-02-03 02:45:27.024  INFO [loyalty-service,,] 1 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat initialized with port(s): 1025 (http)
2023-02-03 02:45:27.353  INFO [loyalty-service,,] 1 --- [           main] o.apache.catalina.core.StandardService   : Starting service [Tomcat]
2023-02-03 02:45:27.353  INFO [loyalty-service,,] 1 --- [           main] org.apache.catalina.core.StandardEngine  : Starting Servlet engine: [Apache Tomcat/9.0.65]
2023-02-03 02:45:27.574  INFO [loyalty-service,,] 1 --- [           main] o.a.c.c.C.[Tomcat].[localhost].[/]       : Initializing Spring embedded WebApplicationContext
2023-02-03 02:45:27.574  INFO [loyalty-service,,] 1 --- [           main] w.s.c.ServletWebServerApplicationContext : Root WebApplicationContext: initialization completed in 5635 ms
2023-02-03 02:45:35.327  INFO [loyalty-service,,] 1 --- [           main] DiscoveryClientOptionalArgsConfiguration : Eureka HTTP Client uses RestTemplate.
2023-02-03 02:45:35.946  WARN [loyalty-service,,] 1 --- [           main] iguration$LoadBalancerCaffeineWarnLogger : Spring Cloud LoadBalancer is currently working with the default cache. While this cache implementation is useful for development and tests, it's recommended to use Caffeine cache in production.You can switch to using Caffeine cache, by adding it and org.springframework.cache.caffeine.CaffeineCacheManager to the classpath.
2023-02-03 02:45:36.141  INFO [loyalty-service,,] 1 --- [           main] o.s.b.a.e.web.EndpointLinksResolver      : Exposing 16 endpoint(s) beneath base path '/actuator'
2023-02-03 02:45:36.543  INFO [loyalty-service,,] 1 --- [           main] o.a.k.clients.consumer.ConsumerConfig    : ConsumerConfig values: 
        allow.auto.create.topics = true
        auto.commit.interval.ms = 5000
        auto.offset.reset = latest
        bootstrap.servers = [ehreddog27153mike11974.servicebus.windows.net:9093]
        check.crcs = true
        client.dns.lookup = use_all_dns_ips
        client.id = consumer-loyalty-service-1
        client.rack = 
        connections.max.idle.ms = 540000
        default.api.timeout.ms = 60000
        enable.auto.commit = false
        exclude.internal.topics = true
        fetch.max.bytes = 52428800
        fetch.max.wait.ms = 500
        fetch.min.bytes = 1
        group.id = loyalty-service
        group.instance.id = null
        heartbeat.interval.ms = 3000
        interceptor.classes = []
        internal.leave.group.on.close = true
        internal.throw.on.fetch.stable.offset.unsupported = false
        isolation.level = read_uncommitted
        key.deserializer = class org.apache.kafka.common.serialization.StringDeserializer
        max.partition.fetch.bytes = 1048576
        max.poll.interval.ms = 300000
        max.poll.records = 500
        metadata.max.age.ms = 300000
        metric.reporters = []
        metrics.num.samples = 2
        metrics.recording.level = INFO
        metrics.sample.window.ms = 30000
        partition.assignment.strategy = [class org.apache.kafka.clients.consumer.RangeAssignor, class org.apache.kafka.clients.consumer.CooperativeStickyAssignor]
        receive.buffer.bytes = 65536
        reconnect.backoff.max.ms = 1000
        reconnect.backoff.ms = 50
        request.timeout.ms = 30000
        retry.backoff.ms = 100
        sasl.client.callback.handler.class = null
        sasl.jaas.config = [hidden]
        sasl.kerberos.kinit.cmd = /usr/bin/kinit
        sasl.kerberos.min.time.before.relogin = 60000
        sasl.kerberos.service.name = null
        sasl.kerberos.ticket.renew.jitter = 0.05
        sasl.kerberos.ticket.renew.window.factor = 0.8
        sasl.login.callback.handler.class = null
        sasl.login.class = null
        sasl.login.connect.timeout.ms = null
        sasl.login.read.timeout.ms = null
        sasl.login.refresh.buffer.seconds = 300
        sasl.login.refresh.min.period.seconds = 60
        sasl.login.refresh.window.factor = 0.8
        sasl.login.refresh.window.jitter = 0.05
        sasl.login.retry.backoff.max.ms = 10000
        sasl.login.retry.backoff.ms = 100
        sasl.mechanism = PLAIN
        sasl.oauthbearer.clock.skew.seconds = 30
        sasl.oauthbearer.expected.audience = null
        sasl.oauthbearer.expected.issuer = null
        sasl.oauthbearer.jwks.endpoint.refresh.ms = 3600000
        sasl.oauthbearer.jwks.endpoint.retry.backoff.max.ms = 10000
        sasl.oauthbearer.jwks.endpoint.retry.backoff.ms = 100
        sasl.oauthbearer.jwks.endpoint.url = null
        sasl.oauthbearer.scope.claim.name = scope
        sasl.oauthbearer.sub.claim.name = sub
        sasl.oauthbearer.token.endpoint.url = null
        security.protocol = SASL_SSL
        security.providers = null
        send.buffer.bytes = 131072
        session.timeout.ms = 45000
        socket.connection.setup.timeout.max.ms = 30000
        socket.connection.setup.timeout.ms = 10000
        ssl.cipher.suites = null
        ssl.enabled.protocols = [TLSv1.2, TLSv1.3]
        ssl.endpoint.identification.algorithm = https
        ssl.engine.factory.class = null
        ssl.key.password = null
        ssl.keymanager.algorithm = SunX509
        ssl.keystore.certificate.chain = null
        ssl.keystore.key = null
        ssl.keystore.location = null
        ssl.keystore.password = null
        ssl.keystore.type = JKS
        ssl.protocol = TLSv1.3
        ssl.provider = null
        ssl.secure.random.implementation = null
        ssl.trustmanager.algorithm = PKIX
        ssl.truststore.certificates = null
        ssl.truststore.location = null
        ssl.truststore.password = null
        ssl.truststore.type = JKS
        value.deserializer = class org.springframework.kafka.support.serializer.JsonDeserializer

2023-02-03 02:45:36.649  INFO [loyalty-service,,] 1 --- [           main] org.apache.kafka.common.metrics.Metrics  : Metrics scheduler closed
2023-02-03 02:45:36.649  INFO [loyalty-service,,] 1 --- [           main] org.apache.kafka.common.metrics.Metrics  : Closing reporter org.apache.kafka.common.metrics.JmxReporter
2023-02-03 02:45:36.650  INFO [loyalty-service,,] 1 --- [           main] org.apache.kafka.common.metrics.Metrics  : Metrics reporters closed
2023-02-03 02:45:36.651  INFO [loyalty-service,,] 1 --- [           main] o.a.kafka.common.utils.AppInfoParser     : App info kafka.consumer for consumer-loyalty-service-1 unregistered
2023-02-03 02:45:36.651  WARN [loyalty-service,,] 1 --- [           main] ConfigServletWebServerApplicationContext : Exception encountered during context initialization - cancelling refresh attempt: org.springframework.context.ApplicationContextException: Failed to start bean 'org.springframework.kafka.config.internalKafkaListenerEndpointRegistry'; nested exception is org.apache.kafka.common.KafkaException: Failed to construct kafka consumer
2023-02-03 02:45:36.728  INFO [loyalty-service,,] 1 --- [           main] o.apache.catalina.core.StandardService   : Stopping service [Tomcat]
2023-02-03 02:45:36.753  INFO [loyalty-service,,] 1 --- [           main] ConditionEvaluationReportLoggingListener : 

Error starting ApplicationContext. To display the conditions report re-run your application with 'debug' enabled.
2023-02-03 02:45:36.828 ERROR [loyalty-service,,] 1 --- [           main] o.s.boot.SpringApplication               : Application run failed

org.springframework.context.ApplicationContextException: Failed to start bean 'org.springframework.kafka.config.internalKafkaListenerEndpointRegistry'; nested exception is org.apache.kafka.common.KafkaException: Failed to construct kafka consumer
        at org.springframework.context.support.DefaultLifecycleProcessor.doStart(DefaultLifecycleProcessor.java:181) ~[spring-context-5.3.22.jar:5.3.22]
        at org.springframework.context.support.DefaultLifecycleProcessor.access$200(DefaultLifecycleProcessor.java:54) ~[spring-context-5.3.22.jar:5.3.22]
        at org.springframework.context.support.DefaultLifecycleProcessor$LifecycleGroup.start(DefaultLifecycleProcessor.java:356) ~[spring-context-5.3.22.jar:5.3.22]
        at java.base/java.lang.Iterable.forEach(Iterable.java:75) ~[na:na]
        at org.springframework.context.support.DefaultLifecycleProcessor.startBeans(DefaultLifecycleProcessor.java:155) ~[spring-context-5.3.22.jar:5.3.22]
        at org.springframework.context.support.DefaultLifecycleProcessor.onRefresh(DefaultLifecycleProcessor.java:123) ~[spring-context-5.3.22.jar:5.3.22]
        at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:935) ~[spring-context-5.3.22.jar:5.3.22]
        at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:586) ~[spring-context-5.3.22.jar:5.3.22]
        at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:147) ~[spring-boot-2.7.2-SNAPSHOT.jar:2.7.2-SNAPSHOT]
        at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:734) ~[spring-boot-2.7.2-SNAPSHOT.jar:2.7.2-SNAPSHOT]
        at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:408) ~[spring-boot-2.7.2-SNAPSHOT.jar:2.7.2-SNAPSHOT]
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:308) ~[spring-boot-2.7.2-SNAPSHOT.jar:2.7.2-SNAPSHOT]
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1306) ~[spring-boot-2.7.2-SNAPSHOT.jar:2.7.2-SNAPSHOT]
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1295) ~[spring-boot-2.7.2-SNAPSHOT.jar:2.7.2-SNAPSHOT]
        at com.microsoft.gbb.reddog.loyaltyservice.LoyaltyServiceApplication.main(LoyaltyServiceApplication.java:12) ~[classes/:0.0.1-SNAPSHOT]
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:na]
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[na:na]
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:na]
        at java.base/java.lang.reflect.Method.invoke(Method.java:568) ~[na:na]
        at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:49) ~[workspace/:na]
        at org.springframework.boot.loader.Launcher.launch(Launcher.java:108) ~[workspace/:na]
        at org.springframework.boot.loader.Launcher.launch(Launcher.java:58) ~[workspace/:na]
        at org.springframework.boot.loader.JarLauncher.main(JarLauncher.java:65) ~[workspace/:na]
Caused by: org.apache.kafka.common.KafkaException: Failed to construct kafka consumer
        at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:823) ~[kafka-clients-3.1.1.jar:na]
        at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:664) ~[kafka-clients-3.1.1.jar:na]
        at org.springframework.kafka.core.DefaultKafkaConsumerFactory.createRawConsumer(DefaultKafkaConsumerFactory.java:483) ~[spring-kafka-2.8.8.jar:2.8.8]
        at org.springframework.kafka.core.DefaultKafkaConsumerFactory.createKafkaConsumer(DefaultKafkaConsumerFactory.java:451) ~[spring-kafka-2.8.8.jar:2.8.8]
        at org.springframework.kafka.core.DefaultKafkaConsumerFactory.createConsumerWithAdjustedProperties(DefaultKafkaConsumerFactory.java:427) ~[spring-kafka-2.8.8.jar:2.8.8]
        at org.springframework.kafka.core.DefaultKafkaConsumerFactory.createKafkaConsumer(DefaultKafkaConsumerFactory.java:394) ~[spring-kafka-2.8.8.jar:2.8.8]
        at org.springframework.kafka.core.DefaultKafkaConsumerFactory.createConsumer(DefaultKafkaConsumerFactory.java:371) ~[spring-kafka-2.8.8.jar:2.8.8]
        at org.springframework.kafka.listener.KafkaMessageListenerContainer$ListenerConsumer.<init>(KafkaMessageListenerContainer.java:776) ~[spring-kafka-2.8.8.jar:2.8.8]
        at org.springframework.kafka.listener.KafkaMessageListenerContainer.doStart(KafkaMessageListenerContainer.java:352) ~[spring-kafka-2.8.8.jar:2.8.8]
        at org.springframework.kafka.listener.AbstractMessageListenerContainer.start(AbstractMessageListenerContainer.java:461) ~[spring-kafka-2.8.8.jar:2.8.8]
        at org.springframework.kafka.listener.ConcurrentMessageListenerContainer.doStart(ConcurrentMessageListenerContainer.java:209) ~[spring-kafka-2.8.8.jar:2.8.8]
        at org.springframework.kafka.listener.AbstractMessageListenerContainer.start(AbstractMessageListenerContainer.java:461) ~[spring-kafka-2.8.8.jar:2.8.8]
        at org.springframework.kafka.config.KafkaListenerEndpointRegistry.startIfNecessary(KafkaListenerEndpointRegistry.java:347) ~[spring-kafka-2.8.8.jar:2.8.8]
        at org.springframework.kafka.config.KafkaListenerEndpointRegistry.start(KafkaListenerEndpointRegistry.java:292) ~[spring-kafka-2.8.8.jar:2.8.8]
        at org.springframework.context.support.DefaultLifecycleProcessor.doStart(DefaultLifecycleProcessor.java:178) ~[spring-context-5.3.22.jar:5.3.22]
        ... 22 common frames omitted
Caused by: java.lang.IllegalArgumentException: Login module control flag not specified in JAAS config
        at org.apache.kafka.common.security.JaasConfig.parseAppConfigurationEntry(JaasConfig.java:110) ~[kafka-clients-3.1.1.jar:na]
        at org.apache.kafka.common.security.JaasConfig.<init>(JaasConfig.java:63) ~[kafka-clients-3.1.1.jar:na]
        at org.apache.kafka.common.security.JaasContext.load(JaasContext.java:88) ~[kafka-clients-3.1.1.jar:na]
        at org.apache.kafka.common.security.JaasContext.loadClientContext(JaasContext.java:82) ~[kafka-clients-3.1.1.jar:na]
        at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:167) ~[kafka-clients-3.1.1.jar:na]
        at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:81) ~[kafka-clients-3.1.1.jar:na]
        at org.apache.kafka.clients.ClientUtils.createChannelBuilder(ClientUtils.java:105) ~[kafka-clients-3.1.1.jar:na]
        at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:736) ~[kafka-clients-3.1.1.jar:na]
        ... 36 common frames omitted


Native Memory Tracking:

Total: reserved=954047886, committed=587173262
-                 Java Heap (reserved=402653184, committed=402653184)
                            (mmap: reserved=402653184, committed=402653184) 
 
-                     Class (reserved=122897548, committed=9520268)
                            (classes #13885)
                            (  instance classes #12951, array classes #934)
                            (malloc=1262732 #30510) 
                            (mmap: reserved=121634816, committed=8257536) 
                            (  Metadata:   )
                            (    reserved=58720256, committed=55115776)
                            (    used=54833368)
                            (    waste=282408 =0.51%)
                            (  Class space:)
                            (    reserved=121634816, committed=8257536)
                            (    used=8029288)
                            (    waste=228248 =2.76%)
 
-                    Thread (reserved=21108240, committed=1857040)
                            (thread #20)
                            (stack: reserved=21049344, committed=1798144)
                            (malloc=37632 #130) 
                            (arena=21264 #38)
 
-                      Code (reserved=255330160, committed=24823664)
                            (malloc=1701744 #7901) 
                            (mmap: reserved=253628416, committed=23121920) 
 
-                        GC (reserved=1343170, committed=1343170)
                            (malloc=24258 #83) 
                            (mmap: reserved=1318912, committed=1318912) 
 
-                  Compiler (reserved=237224, committed=237224)
                            (malloc=66696 #756) 
                            (arena=170528 #7)
 
-                     JVMCI (reserved=104, committed=104)
                            (malloc=104 #7) 
 
-                  Internal (reserved=435246, committed=435246)
                            (malloc=398382 #9524) 
                            (mmap: reserved=36864, committed=36864) 
 
-                     Other (reserved=16384, committed=16384)
                            (malloc=16384 #2) 
 
-                    Symbol (reserved=15308984, committed=15308984)
                            (malloc=13860320 #364046) 
                            (arena=1448664 #1)
 
-    Native Memory Tracking (reserved=6710808, committed=6710808)
                            (malloc=5752 #81) 
                            (tracking overhead=6705056)
 
-        Shared class space (reserved=12582912, committed=12447744)
                            (mmap: reserved=12582912, committed=12447744) 
 
-               Arena Chunk (reserved=55873480, committed=55873480)
                            (malloc=55873480) 
 
-                   Tracing (reserved=33041, committed=33041)
                            (malloc=313 #6) 
                            (arena=32728 #1)
 
-                   Logging (reserved=5220, committed=5220)
                            (malloc=5220 #219) 
 
-                 Arguments (reserved=3325, committed=3325)
                            (malloc=3325 #113) 
 
-                    Module (reserved=406832, committed=406832)
                            (malloc=406832 #2657) 
 
-                 Safepoint (reserved=8192, committed=8192)
                            (mmap: reserved=8192, committed=8192) 
 
-           Synchronization (reserved=77184, committed=77184)
                            (malloc=77184 #864) 
 
-            Serviceability (reserved=984, committed=984)
                            (malloc=984 #14) 
 
-                 Metaspace (reserved=58990000, committed=55385520)
                            (malloc=269744 #185) 
                            (mmap: reserved=58720256, committed=55115776) 
 
-      String Deduplication (reserved=704, committed=704)
                            (malloc=704 #8) 
 
-           Object Monitors (reserved=24960, committed=24960)
                            (malloc=24960 #120) 

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.