guardian / amigo Goto Github PK
View Code? Open in Web Editor NEWAMIgo: An AMI bakery
Home Page: https://amigo.gutools.co.uk/
AMIgo: An AMI bakery
Home Page: https://amigo.gutools.co.uk/
I.e. extract them from the Amigo code so a deploy is not required to update the availble roles.
Some suggestions:
This is the default behaviour of Java runtimes (in both Java 8 & 11 apparently), defined in the java.security
file - they cache DNS hits forever:
# The Java-level namelookup cache policy for successful lookups:
#
# any negative value: caching forever
# any positive value: the number of seconds to cache an address for
# zero: do not cache
#
# default value is forever (FOREVER). For security reasons, this
# caching is made forever when a security manager is set. When a security
# manager is not set, the default behavior in this implementation
# is to cache for 30 seconds.
#
# NOTE: setting this to anything other than the default value can have
# serious security implications. Do not set it unless
# you are sure you are not exposed to DNS spoofing attack.
#
#networkaddress.cache.ttl=-1
Although intended as a security measure against DNS-spoofing, it's not very realistic in the AWS-based-world in which we operate - services do change their IP addresses from time to time, and so AWS recommend that a networkaddress.cache.ttl=60
setting be applied.
On the Ophan team @amyhughes & I have seen this result in us losing monitoring data as the Elastic-hosted monitoring cluster changed it's IP without our Elasticsearch nodes noticing- they attempted to continue sending data to the old IP addresses.
Elastic themselves recommend setting networkaddress.cache.ttl
appropriately.
See also https://stackoverflow.com/q/1256556/438886
java.security
configuration fileLocating and patching the java.security
file is a little fiddly - this is where you find it on today's images:
/etc/java-8-openjdk/security/java.security
Could we bake the updated setting into the AMI role?
trying my first Amigo build, it bombed out at:
[2016-11-04 12:23:02] ubuntu statsd base: Executing Ansible: cd /tmp/packer-provisioner-ansible-local && ANSIBLE_FORCE_COLOR=1 PYTHONUNBUFFERED=1 ansible-playbook /tmp/packer-provisioner-ansible-local/amigo-ansible-ubuntu statsd base3628180008087539732.yml --verbose -c local -i /tmp/packer-provisioner-ansible-local/packer-provisioner-ansible-local681988031
[2016-11-04 12:23:07] ubuntu statsd base: ERROR! the playbook: /tmp/packer-provisioner-ansible-local/amigo-ansible-ubuntu could not be found
????
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar,canner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar
Dependency Hierarchy:
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.9.5.jar
Dependency Hierarchy:
Found in HEAD commit: 42037f878b435e42e9262b44a73ceda0cdcf2a34
Found in base branch: main
FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Publish Date: 2019-01-02
URL: CVE-2018-14720
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14720
Release Date: 2019-01-02
Fix Resolution: 2.9.7
Step up your Open Source Security Game with WhiteSource here
Also need to make the events endpoint filter by bake ID
Every endpoint should require Google auth.
Once we have auth, we can add createdBy
and modifiedBy
to base images, recipes and bakes.
Instead of hardcoding the AMI ID, it should have some kind of query condition e.g. "the latest eu-west-1 hvm:ebs-ssd AMI".
Prism can give us this info, and maybe there's a corresponding API for https://cloud-images.ubuntu.com/locator/ec2/ ?
The logs should be shown inside a fixed size panel, autoscrolling as new logs appear.
It's supposed to keep the scollbar at the bottom of the well, but it actually starts off about halfway down and gradually catches up with the tail as the log gets longer. Looks like I got my height calculations wrong somewhere.
Currently the Packer output is very hard to read. Make it a π!
The enhanced-networking role doesn't work on the latest Xenial AMIs due to a bug in the driver. However the later Xenial AMIs also include a late enough version of the driver that we no longer need to roll it ourselves.
I suggest that enhanced-networking is taken out of ubuntu-init and included explicitly where needed.
See which recipes are built from a given base image
AMIgo should automatically test all AMIs that it bakes.
Tests would be per-role, defined inside the Ansible role directory. There's an example here
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.9.5.jar
Dependency Hierarchy:
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar,canner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar
Dependency Hierarchy:
Found in HEAD commit: 42037f878b435e42e9262b44a73ceda0cdcf2a34
Found in base branch: main
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Publish Date: 2019-03-21
URL: CVE-2018-12022
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12022
Release Date: 2019-03-21
Fix Resolution: 2.7.9.4, 2.8.11.2, 2.9.6
Step up your Open Source Security Game with WhiteSource here
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.
Library home page: http://netty.io/
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/io.netty/netty-handler/jars/netty-handler-4.0.34.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 42037f878b435e42e9262b44a73ceda0cdcf2a34
Found in base branch: main
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).
Publish Date: 2017-04-13
URL: CVE-2016-4970
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4970
Release Date: 2017-04-13
Fix Resolution: io.netty:netty-all:4.0.37.Final,4.1.1.Final,io.netty:netty-handler:4.0.37.Final,4.1.1.Final
Step up your Open Source Security Game with WhiteSource here
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar,canner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar
Dependency Hierarchy:
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.9.5.jar
Dependency Hierarchy:
Found in HEAD commit: 42037f878b435e42e9262b44a73ceda0cdcf2a34
Found in base branch: main
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
Publish Date: 2019-09-15
URL: CVE-2019-16335
Base Score Metrics:
Type: Upgrade version
Origin: https://github.com/FasterXML/jackson-databind/blob/master/release-notes/VERSION-2.x
Release Date: 2019-09-15
Fix Resolution: 2.9.10
Step up your Open Source Security Game with WhiteSource here
Show "transitive" usages. If I look at a role's usages I generally don't want to see that it's just used in a abase image, but rather all the recipes that are using it.
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar,canner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar
Dependency Hierarchy:
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.9.5.jar
Dependency Hierarchy:
Found in HEAD commit: 42037f878b435e42e9262b44a73ceda0cdcf2a34
Found in base branch: main
FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Publish Date: 2019-01-02
URL: CVE-2018-14721
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14721
Release Date: 2019-01-02
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.7,2.8.11.3,2.7.9.5,2.6.7.3
Step up your Open Source Security Game with WhiteSource here
Not sure how useful this would be, but you could estimate progress based on how long previous bakes took to complete.
If you create a new role and leave the description blank, you get an error page showing a Dynamo exception. This is because we try to save a Dynamo attribute with an empty string value.
Workaround: replace empty string with " "
before saving to Dynamo?
The UI has gone a bit wonky after implementing a few more roles. Should be a simple fix to the bootstrap HTML.
Sometimes we will want to get assets from S3 outside of the account in which amigo is running, there are various ways to achieve this:
Twice now I've SSHed into a long-running instance to find kswapd
going crazy. Maybe we are leaking some resource every time we run Packer? Or maybe t2.micro is simply too small.
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.9.5.jar
Dependency Hierarchy:
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar,canner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar
Dependency Hierarchy:
Found in HEAD commit: 42037f878b435e42e9262b44a73ceda0cdcf2a34
Found in base branch: main
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
Publish Date: 2019-10-12
URL: CVE-2019-17531
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17531
Release Date: 2019-10-12
Fix Resolution: 2.10
Step up your Open Source Security Game with WhiteSource here
Sometimes I want to make an almost identical recipe to an already existing one.
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar,canner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar
Dependency Hierarchy:
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.9.5.jar
Dependency Hierarchy:
Found in HEAD commit: 42037f878b435e42e9262b44a73ceda0cdcf2a34
Found in base branch: main
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
Publish Date: 2019-09-15
URL: CVE-2019-14540
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14540
Release Date: 2019-09-15
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.8.11.5,2.9.10,2.10.0.pr3,2.11.0.rc1
Step up your Open Source Security Game with WhiteSource here
Ansible does some fancy-pants logging in which it overwrites the line using \r
. Currently we print this in a rather unsightly way:
(Reading database ... (Reading database ... 5% (Reading database ... 10% (Reading database ... 15% (Reading database ... 20% (Reading database ... 25% (Reading database ... 30% (Reading database ... 35% (Reading database ... 40% (Reading database ... 45% (Reading database ... 50% (Reading database ... 55% (Reading database ... 60% (Reading database ... 65% (Reading database ... 70% (Reading database ... 75% (Reading database ... 80% (Reading database ... 85% (Reading database ... 90% (Reading database ... 95% (Reading database ... 100% (Reading database ... 58006 files and directories currently installed.)
We could avoid this if we implemented proper support for \r
, i.e. delete everything from the start of the current line to this point.
At present dependencies between base image and role are not enforced (for example pluto requires a redhat base).
For each recipe, you should have the option of specifying "bake this every N days"
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.9.5.jar
Dependency Hierarchy:
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar,canner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar
Dependency Hierarchy:
Found in HEAD commit: 42037f878b435e42e9262b44a73ceda0cdcf2a34
Found in base branch: main
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
Publish Date: 2020-04-07
URL: CVE-2020-11619
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11619
Release Date: 2020-04-07
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10.4
Step up your Open Source Security Game with WhiteSource here
Recipes only show explicit roles in the UI. It should show dependent roles as well as those that are present by virtue of being in the provided base image.
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.9.5.jar
Dependency Hierarchy:
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar,canner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar
Dependency Hierarchy:
Found in HEAD commit: 42037f878b435e42e9262b44a73ceda0cdcf2a34
Found in base branch: main
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.
Publish Date: 2019-05-17
URL: CVE-2019-12086
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12086
Release Date: 2019-05-17
Fix Resolution: 2.9.9
Step up your Open Source Security Game with WhiteSource here
For one thing, this would make it easier to decide whether you can safely redeploy the app without killing someone's bake.
Core Jackson abstractions, basic JSON streaming API implementation
Library home page: https://github.com/FasterXML/jackson-core
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-core/bundles/jackson-core-2.7.1.jar
Dependency Hierarchy:
Found in HEAD commit: 42037f878b435e42e9262b44a73ceda0cdcf2a34
Found in base branch: main
OutOfMemoryError when writing BigDecimal In Jackson Core before version 2.7.7.
When enabled the WRITE_BIGDECIMAL_AS_PLAIN setting, Jackson will attempt to write out the whole number, no matter how large the exponent.
Publish Date: 2016-08-25
URL: WS-2018-0125
Base Score Metrics:
Type: Upgrade version
Origin: https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.7.7
Release Date: 2016-08-25
Fix Resolution: com.fasterxml.jackson.core:jackson-core:2.7.7
Step up your Open Source Security Game with WhiteSource here
Like machine-images does.
Core Jackson abstractions, basic JSON streaming API implementation
Library home page: https://github.com/FasterXML/jackson-core
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-core/bundles/jackson-core-2.7.1.jar
Dependency Hierarchy:
Found in HEAD commit: 42037f878b435e42e9262b44a73ceda0cdcf2a34
Found in base branch: main
In Jackson Core before version 2.8.6 if the REST endpoint consumes POST requests with JSON or XML data and data are invalid, the first unrecognized token is printed to server.log. If the first token is word of length 10MB, the whole word is printed. This is potentially dangerous and can be used to attack the server by filling the disk with logs.
Publish Date: 2018-06-24
URL: WS-2018-0124
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=WS-2018-0124
Release Date: 2018-01-24
Fix Resolution: 2.8.6
Step up your Open Source Security Game with WhiteSource here
So we can use the fancy new query API
The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/commons-codec/commons-codec/jars/commons-codec-1.10.jar
Dependency Hierarchy:
Found in HEAD commit: 42037f878b435e42e9262b44a73ceda0cdcf2a34
Found in base branch: main
Apache commons-codec before version βcommons-codec-1.13-RC1β is vulnerable to information disclosure due to Improper Input validation.
Publish Date: 2019-05-20
URL: WS-2019-0379
Base Score Metrics:
Type: Upgrade version
Origin: apache/commons-codec@48b6157
Release Date: 2019-05-20
Fix Resolution: commons-codec:commons-codec:1.13
Step up your Open Source Security Game with WhiteSource here
As observed by @SHession. In order to continue the cooking metaphor, roles should really be called ingredients as you bake
a mixture of ingredients
when following a recipe
.
I'd like to build the image for Kong 0.7.x using AMIgo.
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.9.5.jar
Dependency Hierarchy:
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar,canner/.ivy2/cache/com.fasterxml.jackson.core/jackson-databind/bundles/jackson-databind-2.7.1.jar
Dependency Hierarchy:
Found in HEAD commit: 42037f878b435e42e9262b44a73ceda0cdcf2a34
Found in base branch: main
An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Publish Date: 2019-03-21
URL: CVE-2018-12023
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12022
Release Date: 2019-03-21
Fix Resolution: 2.7.9.4, 2.8.11.2, 2.9.6
Step up your Open Source Security Game with WhiteSource here
Recent versions of logstash have architecture-specific downloads (e.g. 7.10.1) compared with older versions (e.g. 7.8.1).
This means that for 7.10.1
you would have to submit e.g. 7.10.1-amd64
as the version number parameter value in the logstash-deb
role. Possibly ok π€·ββοΈ but this does require developers to construct a URI which resolves to the logstash artifact.
Issue can impact developer productivity: since installing logstash on the AMI is typically at the end of the bake, if they aren't aware of this version quirk, it will take ~ time of a bake before they are.
You get a Dynamo update expression if you try to update a recipe that does not have a description.
Caused by: com.amazonaws.services.dynamodbv2.model.AmazonDynamoDBException:
Invalid UpdateExpression: An expression attribute value used in expression is not defined;
attribute value: :l_l_l_l_l_update (Service: AmazonDynamoDBv2; Status Code: 400; Error Code: ValidationException; Request ID: 99ISP9BG3VA2D46N2VPV099UUVVV4KQNSO5AEMVJF66Q9ASUAAJG)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1579)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeOneRequest(AmazonHttpClient.java:1249)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1030)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:742)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:716)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:699)
at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:667)
at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:649)
at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:513)
at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.doInvoke(AmazonDynamoDBClient.java:1974)
at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.invoke(AmazonDynamoDBClient.java:1950)
at com.amazonaws.services.dynamodbv2.AmazonDynamoDBClient.updateItem(AmazonDynamoDBClient.java:1708)
at com.gu.scanamo.ops.ScanamoInterpreters$$anon$1.apply(ScanamoInterpreters.scala:75)
at com.gu.scanamo.ops.ScanamoInterpreters$$anon$1.apply(ScanamoInterpreters.scala:50)
at cats.free.Free$$anonfun$foldMap$1.apply(Free.scala:126)
at cats.free.Free$$anonfun$foldMap$1.apply(Free.scala:124)
at cats.package$$anon$1.tailRecM(package.scala:36)
at cats.free.Free.foldMap(Free.scala:124)
at cats.free.Free$$anonfun$foldMap$1.apply(Free.scala:127)
at cats.free.Free$$anonfun$foldMap$1.apply(Free.scala:124)
at cats.package$$anon$1.tailRecM(package.scala:36)
at cats.free.Free.foldMap(Free.scala:124)
at com.gu.scanamo.Scanamo$.exec(Scanamo.scala:17)
at data.Dynamo$RichScanamoOps$.exec$extension(Dynamo.scala:97)
at data.Recipes$.update(Recipes.scala:55)
at controllers.RecipeController$$anonfun$updateRecipe$1$$anonfun$apply$6$$anonfun$apply$8.apply(RecipeController.scala:59)
at controllers.RecipeController$$anonfun$updateRecipe$1$$anonfun$apply$6$$anonfun$apply$8.apply(RecipeController.scala:54)
...
The update is defined as below:
val update = table.update('id -> recipe.id,
set('description -> description) and
set('baseImageId -> baseImage.id) and
set('roles -> roles) and
set('modifiedBy -> modifiedBy) and
set('modifiedAt -> DateTime.now()) and
(if (bakeSchedule.isDefined) set('bakeSchedule -> bakeSchedule) else remove('bakeSchedule))
)
I think the fix would be to only include Description
in the update expression if it has been set, like we do for bakeSchedule
?
Probably introduced by #28
AMIs should be tagged with information about what features they contain.
Should talk to @sihil and @adamnfish to decide on a format for tags that both Riff Raff and AMIable understand.
Should also add the AMIgo recipe ID as a tag.
This is boring, but I can't put it off forever...
We still need the following pages:
/base-images/:id
- display detailed info about a base image/base-images/:id/edit
- form to update a base image/base-images/new
- form to create a base image/roles/:id
- display info extracted from the role's files. Render README.md if there is one available. Display any variables that the role accepts, along with their default values./recipes/:id
- display detailed info about the recipe at top of page. Underneath, show a list of recently completed or running bakes, linking to the corresponding bake pages. Put a big Bake! button somewhere on the page./recipes/:id/edit
- form to update a recipe/recipes/new
- form to create a recipe/bake/:id
- show logs for a bake. Updates in real time using SSE.Google OAuth Client Library for Java. Functionality that works on all supported Java platforms, including Java 5 (or higher) desktop (SE) and web (EE), Android, and Google App Engine.
Library home page: https://github.com/google/google-oauth-java-client
Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.google.oauth-client/google-oauth-client/jars/google-oauth-client-1.20.0.jar
Dependency Hierarchy:
Found in HEAD commit: 42037f878b435e42e9262b44a73ceda0cdcf2a34
Found in base branch: main
PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
Publish Date: 2020-07-09
URL: CVE-2020-7692
Base Score Metrics:
Type: Upgrade version
Origin: https://github.com/FriendsOfSymfony/oauth2-php/releases/tag/1.3.0
Release Date: 2020-07-09
Fix Resolution: 1.3.0
Step up your Open Source Security Game with WhiteSource here
URL = /roles/:id
A declarative, efficient, and flexible JavaScript library for building user interfaces.
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. πππ
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google β€οΈ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.