kedacore / external-scaler-azure-cosmos-db Goto Github PK

View Code? Open in Web Editor NEW

10.0 7.0 8.0 272 KB

KEDA External Scaler for Azure Cosmos DB

License: Apache License 2.0

Dockerfile 4.56% C# 95.44%

azure autoscaling keda azure-cosmos-db

external-scaler-azure-cosmos-db's Introduction

KEDA External Scaler for Azure Cosmos DB

Event-based autoscaler for your Azure Cosmos DB change feed consumer applications running inside Kubernetes cluster.

Architecture

Following diagram shows the different components that are involved for achieving the application scaling, and the relationships between these components.

Monitored Container - The Azure Cosmos DB container that the application needs to monitor for new changes. A Cosmos DB container might contain several logical partitions based on the presence of distinct values of partition keys. Different logical partitions will be grouped under the same Partition Range if they are stored on the same physical partition. For more information, please read the documentation on partitioning overview. In general, for containers that do not contain large amount of data, the count of physical partitions does not exceed 1.
Lease Container - Another Azure Cosmos DB container that keeps track of changes happening on the monitored container. It stores the list of changes in the Change Feed. The change feed design pattern supports multiple parallel listeners by keeping independent feeds for each partition range. The listener application instances acquire leases on these individual feeds before processing them. This ensures that a change is not processed by multiple applications. You may have both monitored and lease containers in the same Cosmos DB account, but they can also be situated in different accounts.
KEDA - KEDA runs as a separate service in Kubernetes cluster. It enables auto-scaling of applications based on internal and more primarily, external events. Check KEDA documentation to learn more.
External Scaler - While KEDA ships with a set of built-in scalers, it also allows users to extend KEDA through support for external scalers. In this scheme, KEDA will query user's GRPC service to fetch metrics of an event source and will scale the applications accordingly. This is where 'KEDA external scaler for Azure Cosmos DB' plugs itself in. For information on how an external scaler can be implemented, check KEDA external scaler concept.
Listener Application(s) - This represents the application Deployment or StatefulSet that you would like to scale in and out using KEDA and the external scaler. For information on how to setup the change feed processor in your application that processes changes in Cosmos DB container, read documentation on change feed processing.
ScaledObject Spec - The specification contains information about the scale target (i.e. the application Deployment that needs to be scaled) and the trigger metadata. The external scaler fetches information about the Cosmos DB lease container from the trigger metadata defined in the ScaledObject resource.

The external scaler calls Cosmos DB APIs to estimate the amount of changes pending to be processed. More specifically, the scaler counts the number of partition ranges that have changes remaining to be processed, and requests KEDA to scale the application to that amount.

Note: The architectural diagram above shows KEDA, external scaler and the target application in different Kubernetes namespaces. This is possible but not necessary. It is a requirement though that the ScaledObject and the application Deployment reside in the same namespace.

Setup Instructions

⚠️ Caution: The Java SDK v2 client library uses a different naming convention for lease documents inside the lease container. This makes it incompatible with .NET SDK v3, the one that the external scaler depends on to estimate the pending changes on change feeds. Hence, if you have a Java-based target consumer application, your change feeds would be having lease documents with incompatible IDs, and the external scaler would be unable to detect any pending change remaining to be consumed. Consequently, it will scale down your application to minReplicaCount if defined in the ScaledObject or to zero instances.

Deploy KEDA and External Scaler

Add and update Helm chart repo.

helm repo add kedacore https://kedacore.github.io/charts
helm repo update

Install KEDA Helm chart (or follow one of the other installation methods on KEDA documentation).
```
helm install keda kedacore/keda --namespace keda --create-namespace
```

Install Azure Cosmos DB external scaler Helm chart.

helm install external-scaler-azure-cosmos-db kedacore/external-scaler-azure-cosmos-db --namespace keda --create-namespace

Create `ScaledObject` Resource

Create ScaledObject resource that contains the information about your application (the scale target), the external scaler service, Cosmos DB containers, and other scaling configuration values. Check ScaledObject specification and External trigger specification for information on different properties supported for ScaledObject and their allowed values.

You can use file deploy/deploy-scaledobject.yaml as a template for creating the ScaledObject. The trigger metadata properties required to use the external scaler for Cosmos DB are described in Trigger Specification section below.

Note: If you are having trouble setting up the external scaler or the listener application, the step-by-step instructions for deploying the sample application might help.

Trigger Specification

The specification below describes the trigger metadata in ScaledObject resource for using 'KEDA external scaler for Cosmos DB' to scale your application.

  triggers:
    - type: external
      metadata:
        scalerAddress: external-scaler-azure-cosmos-db.keda:4050 # Mandatory. Address of the external scaler service.
        connection: <connection>               # Mandatory. Connection string of Cosmos DB account with monitored container.
        databaseId: <database-id>              # Mandatory. ID of Cosmos DB database containing monitored container.
        containerId: <container-id>            # Mandatory. ID of monitored container.
        leaseConnection: <lease-connection>    # Mandatory. Connection string of Cosmos DB account with lease container.
        leaseDatabaseId: <lease-database-id>   # Mandatory. ID of Cosmos DB database containing lease container.
        leaseContainerId: <lease-container-id> # Mandatory. ID of lease container.
        processorName: <processor-name>        # Mandatory. Name of change-feed processor used by listener application.

Parameter List

scalerAddress - Address of the external scaler service. This would be in format <scaler-name>.<scaler-namespace>:<port>. If you installed Azure Cosmos DB external scaler Helm chart in keda namespace and did not specify custom values, the metadata value would be external-scaler-azure-cosmos-db.keda:4050.
connection - Connection string of the Cosmos DB account that contains the monitored container.
databaseId - ID of Cosmos DB database that contains the monitored container.
containerId - ID of the monitored container.
leaseConnection - Connection string of the Cosmos DB account that contains the lease container. This can be same or different from the value of connection metadata.
leaseDatabaseId - ID of Cosmos DB database that contains the lease container. This can be same or different from the value of databaseId metadata.
leaseContainerId - ID of the lease container containing the change feeds.
processorName - Name of change-feed processor used by listener application. For more information on this, you can refer to Implementing the change feed processor section.

Note Ideally, we would have created TriggerAuthentication resource that would have prevented us from adding the connection strings in plain text in the ScaledObject trigger metadata. However, this is not possible since at the moment, the triggers of external type do not support referencing a TriggerAuthentication resource (link).

external-scaler-azure-cosmos-db's People

Contributors

Stargazers

Watchers

Forkers

divyagandhisethi mblagui isabella232 jatinsanghvi sandeepsnairms

external-scaler-azure-cosmos-db's Issues

Provide GitHub Action to publish official image on GHCR

Provide GitHub Action to publish official image on GHCR based on new Git tag.

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

chore(deps): update nuget packages (Grpc.AspNetCore, Microsoft.Azure.Cosmos, Microsoft.NET.Test.Sdk, Moq, xunit, xunit.runner.visualstudio)

Detected dependencies

dockerfile

src/Scaler.Demo/OrderGenerator/Dockerfile

mcr.microsoft.com/dotnet/sdk 6.0

mcr.microsoft.com/dotnet/runtime 6.0

src/Scaler.Demo/OrderProcessor/Dockerfile

mcr.microsoft.com/dotnet/sdk 6.0

mcr.microsoft.com/dotnet/runtime 6.0

src/Scaler/Dockerfile

mcr.microsoft.com/dotnet/sdk 6.0

mcr.microsoft.com/dotnet/aspnet 6.0

github-actions

.github/workflows/main-build.yml

actions/checkout v4

actions/setup-dotnet v4

docker/build-push-action v4

docker/build-push-action v4

docker/login-action v2

docker/metadata-action v4

docker/build-push-action v4

.github/workflows/pr-build.yml

actions/checkout v4

actions/setup-dotnet v4

docker/build-push-action v4

docker/build-push-action v4

docker/build-push-action v4

.github/workflows/release-build.yml

actions/checkout v4

actions/setup-dotnet v4

docker/build-push-action v4

docker/build-push-action v4

docker/login-action v2

docker/metadata-action v4

docker/build-push-action v4

nuget

src/Scaler.Demo/OrderGenerator/Keda.CosmosDb.Scaler.Demo.OrderGenerator.csproj

Microsoft.Extensions.Hosting 6.0.1

Microsoft.Azure.Cosmos 3.35.3

Bogus 34.0.2

src/Scaler.Demo/OrderProcessor/Keda.CosmosDb.Scaler.Demo.OrderProcessor.csproj

Microsoft.Extensions.Logging 6.0.0

Microsoft.Extensions.Hosting 6.0.1

Microsoft.Azure.Cosmos 3.35.3

src/Scaler.Demo/Shared/Keda.CosmosDb.Scaler.Demo.Shared.csproj

NewtonSoft.Json 13.0.3

Microsoft.Extensions.Hosting 6.0.1

Microsoft.Azure.Cosmos 3.35.3

src/Scaler.Tests/Keda.CosmosDb.Scaler.Tests.csproj

coverlet.collector 3.2.0

xunit.runner.visualstudio 2.5.0

xunit 2.5.0

Moq 4.20.69

Microsoft.NET.Test.Sdk 17.7.2

src/Scaler/Keda.CosmosDb.Scaler.csproj

NewtonSoft.Json 13.0.3

Microsoft.Extensions.Logging 6.0.0

Microsoft.Azure.Cosmos 3.35.3

Grpc.AspNetCore 2.56.0

Check this box to trigger a request for Renovate to run again on this repository

List Cosmos DB external scaler on Artifact Hub

Artifact Hub now supports listing KEDA scalers and it would be nice to list Cosmos DB external scaler on Artifact Hub as well.

We already do this for our HTTP add-on scaler - https://artifacthub.io/packages/keda-scaler/keda-official-external-scalers/keda-add-ons-http.

This should be contributed to https://github.com/kedacore/external-scalers/tree/master/artifacthub and updated for every release.

Provide README

Provide README that gives more information about this external scaler and what to expect

[Feature Request] Scaling on custom query

Any plans to support scaling based on custom query on Cosmosdb like it happens in MSSQL or Mongodb scalers?

CVE-2017-0256 (Medium) detected in system.net.http.4.3.0.nupkg - autoclosed

CVE-2017-0256 - Medium Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /src/Scaler.Tests/Keda.CosmosDb.Scaler.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

xunit.2.4.2.nupkg (Root Library)
- xunit.assert.2.4.2.nupkg
  - netstandard.library.1.6.1.nupkg
    - ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 208c73830a79844b58ff4ae9ee5915696f9d9299

Found in base branch: main

Vulnerability Details

A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Publish Date: 2017-05-12

URL: CVE-2017-0256

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-0256

Release Date: 2017-05-12

Fix Resolution: Microsoft.AspNetCore.Mvc.ApiExplorer - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.Abstractions - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.Core - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.1.3,1.0.4;System.Net.Http - 4.1.2,4.3.2;Microsoft.AspNetCore.Mvc.Razor - 1.1.3,1.0.4;System.Net.Http.WinHttpHandler - 4.0.2,4.3.0-preview1-24530-04;System.Net.Security - 4.3.0-preview1-24530-04,4.0.1;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,1.1.3;System.Text.Encodings.Web - 4.3.0-preview1-24530-04,4.0.1;Microsoft.AspNetCore.Mvc.Razor.Host - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4,1.1.3;System.Net.WebSockets.Client - 4.3.0-preview1-24530-04,4.0.1;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.1.3,1.0.4;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,1.1.3

Step up your Open Source Security Game with Mend here

Azure Functions Support

Expected behavior when implementing this solution is not fully supported when initial container was created from Azure Function using "func kubernetes deploy" or when building native container from mcr azure-function image. Change-Feed Processor does not seem to be configured correctly which prevents solution from scaling appropriately when CosmoDB trigger is executed.

Use-Case

Goal is to perform the following workflow:

Create Azure Function which triggers on CosmosDB changes
Leverage Azure Function Core Tools in order to run functions inside of AKS which creates Dockerfile
Deploy container into AKS and leverage the external ScaledObject via Keda resource

Specification

Test Azure Functions support with CosmosDB trigger to ensure solution works for this scenario.
Test and Validate change-feed processor configuration to ensure the metadata process.Name mandatory field has valid entry

CVE-2019-0820 (High) detected in system.text.regularexpressions.4.3.0.nupkg

CVE-2019-0820 - High Severity Vulnerability

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: /src/Scaler.Tests/Keda.CosmosDb.Scaler.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

xunit.2.5.0.nupkg (Root Library)
- xunit.assert.2.5.0.nupkg
  - netstandard.library.1.6.1.nupkg
    - system.xml.xdocument.4.3.0.nupkg
      - system.xml.readerwriter.4.3.0.nupkg
        
        ❌ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 208c73830a79844b58ff4ae9ee5915696f9d9299

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2019-05-16

Fix Resolution: System.Text.RegularExpressions - 4.3.1

Step up your Open Source Security Game with Mend here

Provide integration tests to verify the scaler is working

Provide integration tests to verify the scaler is working so that:

It calls the endpoint to get the metric value
Value is compared with what open work is left

CVE-2017-0249 (High) detected in system.net.http.4.3.0.nupkg - autoclosed

CVE-2017-0249 - High Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /src/Scaler.Tests/Keda.CosmosDb.Scaler.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

xunit.2.4.2.nupkg (Root Library)
- xunit.assert.2.4.2.nupkg
  - netstandard.library.1.6.1.nupkg
    - ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 208c73830a79844b58ff4ae9ee5915696f9d9299

Found in base branch: main

Vulnerability Details

An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests.

Publish Date: 2017-05-12

URL: CVE-2017-0249

CVSS 3 Score Details (7.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2017-05-12

Fix Resolution: System.Text.Encodings.Web - 4.0.1,4.3.1;System.Net.Http - 4.1.2,4.3.2;System.Net.Http.WinHttpHandler - 4.0.2,4.3.1;System.Net.Security - 4.0.1,4.3.1;System.Net.WebSockets.Client - 4.0.1,4.3.1;Microsoft.AspNetCore.Mvc - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Core - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4,1.1.3

Step up your Open Source Security Game with Mend here

Automatically keep dependencies up-to-date with Renovate

Automatically keep dependencies up-to-date with Renovate to ensure we are patching security vulnerabilities and bugs.

Provide release process guide

Provide release process guide to include the steps required to ship a new version.

It should be fairly similar to https://github.com/kedacore/keda/blob/main/RELEASE-PROCESS.MD and include a note for #7

CVE-2018-8292 (Medium) detected in system.net.http.4.3.0.nupkg

CVE-2018-8292 - Medium Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that allow applications to consume web services over HTTP and HTTP components that can be used by both clients and servers for parsing HTTP headers.

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /src/Scaler.Tests/Keda.CosmosDb.Scaler.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

xunit.2.5.0.nupkg (Root Library)
- xunit.assert.2.5.0.nupkg
  - netstandard.library.1.6.1.nupkg
    - ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 208c73830a79844b58ff4ae9ee5915696f9d9299

Found in base branch: main

Vulnerability Details

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Publish Date: 2018-10-10

URL: CVE-2018-8292

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-10-10

Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1

Step up your Open Source Security Game with Mend here

Update externalscaler.proto to follow protobuf style guidelines

External scaler.proto should follow the style guidelines from here- https://developers.google.com/protocol-buffers/docs/style . This will be a breaking change and needs to be updated as part of major version upgrade.

Provide CI

Provide CI with GitHub Actions that has two jobs:

Build - Builds the solution, runs unit tests
Docker - Build the container image and push to GHCR (master only with :experimental tag)

Support AAD Pod Identity

Add support for using pod identity binding to access the cosmos db via account endpoint only.

Use-Case

Our cosmos dbs are set up to only use AD for access. We would like to create a role with the access that this scaler will need and use that and the account endpoint for access. We would then not need to have connection strings in configuration.

Change image name to ghcr.io/kedacore/keda-external-scaler-azure-cosmos-db

Change image name to ghcr.io/kedacore/keda-external-scaler-azure-cosmos-db to emphasize that it's an external scaler.

Follow-up for #10

CVE-2017-0247 (High) detected in system.net.http.4.3.0.nupkg - autoclosed

CVE-2017-0247 - High Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /src/Scaler.Tests/Keda.CosmosDb.Scaler.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

xunit.2.4.2.nupkg (Root Library)
- xunit.assert.2.4.2.nupkg
  - netstandard.library.1.6.1.nupkg
    - ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 208c73830a79844b58ff4ae9ee5915696f9d9299

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range.

Publish Date: 2017-05-12

URL: CVE-2017-0247

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2017-05-12

Fix Resolution: System.Text.Encodings.Web - 4.0.1,4.3.1;System.Net.Http - 4.1.2,4.3.2;System.Net.Http.WinHttpHandler - 4.0.2,4.5.4;System.Net.Security - 4.0.1,4.3.1;System.Net.WebSockets.Client - 4.0.1,4.3.1;Microsoft.AspNetCore.Mvc - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Core - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.Razor - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4,1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4,1.1.3

Step up your Open Source Security Game with Mend here

CVE-2022-1941 (High) detected in google.protobuf.3.21.5.nupkg - autoclosed

CVE-2022-1941 - High Severity Vulnerability

Vulnerable Library - google.protobuf.3.21.5.nupkg

C# runtime library for Protocol Buffers - Google's data interchange format.

Library home page: https://api.nuget.org/packages/google.protobuf.3.21.5.nupkg

Path to dependency file: /src/Scaler.Tests/Keda.CosmosDb.Scaler.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/google.protobuf/3.21.5/google.protobuf.3.21.5.nupkg

Dependency Hierarchy:

❌ google.protobuf.3.21.5.nupkg (Vulnerable Library)

Found in HEAD commit: 208c73830a79844b58ff4ae9ee5915696f9d9299

Found in base branch: main

Vulnerability Details

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.

Publish Date: 2022-09-22

URL: CVE-2022-1941

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8gq9-2x98-w8hf

Release Date: 2022-09-22

Fix Resolution: protobuf-cpp - 3.18.3,3.19.5,3.20.2,3.21.6;protobuf-python - 3.18.3,3.19.5,3.20.2,4.21.6

Step up your Open Source Security Game with Mend here

Provide Helm chart in KEDA registry

Provide Helm chart in KEDA registry for easy installation.

https://github.com/kedacore/charts

Tasklist

Introduce Helm chart
Extend CI to lint the Helm chart
Update README & installation
Update release process in this repo to add a step for Helm releases
Update release process in Helm repo, if required

CVE-2017-0248 (High) detected in system.net.http.4.3.0.nupkg - autoclosed

CVE-2017-0248 - High Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /src/Scaler.Tests/Keda.CosmosDb.Scaler.Tests.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

xunit.2.4.2.nupkg (Root Library)
- xunit.assert.2.4.2.nupkg
  - netstandard.library.1.6.1.nupkg
    - ❌ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 208c73830a79844b58ff4ae9ee5915696f9d9299

Found in base branch: main

Vulnerability Details

Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka ".NET Security Feature Bypass Vulnerability."

Publish Date: 2017-05-12

URL: CVE-2017-0248

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2017-05-12

Fix Resolution: System.Text.Encodings.Web - 4.0.1, 4.3.1;System.Net.Http - 4.1.2, 4.3.2;System.Net.Http.WinHttpHandler - 4.0.2, 4.3.1;System.Net.Security - 4.0.1, 4.3.1;System.Net.WebSockets.Client - 4.0.1, 4.3.1;Microsoft.AspNetCore.Mvc - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Core - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Abstractions - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.ApiExplorer - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Cors - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.DataAnnotations - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Json - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Formatters.Xml - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Localization - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Razor.Host - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.Razor - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.TagHelpers - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.ViewFeatures - 1.0.4, 1.1.3;Microsoft.AspNetCore.Mvc.WebApiCompatShim - 1.0.4, 1.1.3

Step up your Open Source Security Game with Mend here

kedacore / external-scaler-azure-cosmos-db Goto Github PK

external-scaler-azure-cosmos-db's Introduction

KEDA External Scaler for Azure Cosmos DB

Architecture

Setup Instructions

Deploy KEDA and External Scaler

Create ScaledObject Resource

Trigger Specification

Parameter List

external-scaler-azure-cosmos-db's People

Contributors

Stargazers

Watchers

Forkers

external-scaler-azure-cosmos-db's Issues

Open

Detected dependencies

CVE-2017-0256 - Medium Severity Vulnerability

Use-Case

Specification

CVE-2019-0820 - High Severity Vulnerability

CVE-2017-0249 - High Severity Vulnerability

CVE-2018-8292 - Medium Severity Vulnerability

Use-Case

CVE-2017-0247 - High Severity Vulnerability

CVE-2022-1941 - High Severity Vulnerability

Tasklist

CVE-2017-0248 - High Severity Vulnerability

Recommend Projects

Recommend Topics

Recommend Org

Create `ScaledObject` Resource