Giter Club home page Giter Club logo

seagate / cortx-ha Goto Github PK

View Code? Open in Web Editor NEW
4.0 12.0 45.0 1.41 MB

CORTX ha (High-Availability) is responsible for ensuring that CORTX Solution is available in case of any hardware component or software service failures. It takes care of failover/ failback control flow for affected services and stabilizes them across CORTX cluster.

Home Page: https://github.com/Seagate/cortx

License: GNU Affero General Public License v3.0

Shell 14.11% Python 85.54% Makefile 0.32% Dockerfile 0.02%
s3-storage availability availability-monitor

cortx-ha's People

Contributors

ajay-paratmandali avatar ajaysrivas avatar akash2144 avatar andriytk avatar archanalimaye avatar chumakd avatar gargpalak048 avatar gauravchaudhari02 avatar gauri-bhosale avatar indrajitzagade avatar johnbent avatar knekrasov avatar madhura-08 avatar mariyappanp avatar mukhtar-inamdar avatar mukul-seagate11 avatar pawankumarsrivastava avatar pujamudaliar avatar satish-seagate avatar saumya-sunder avatar shailesh-vaidya avatar shaileshsvc avatar shindeam avatar swanand-gadre avatar techwriter-mayur avatar ujjwalpl avatar venkuppu-chn avatar venkyos avatar vijaythakkar132 avatar vvv avatar

Stargazers

 avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

cortx-ha's Issues

CVE-2020-25659 (Medium) detected in cryptography-2.8-cp34-abi3-manylinux2010_x86_64.whl

CVE-2020-25659 - Medium Severity Vulnerability

Vulnerable Library - cryptography-2.8-cp34-abi3-manylinux2010_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/ca/9a/7cece52c46546e214e10811b36b2da52ce1ea7fa203203a629b8dfadad53/cryptography-2.8-cp34-abi3-manylinux2010_x86_64.whl

Path to dependency file: cortx-ha/jenkins/pyinstaller/v1/requirements.txt

Path to vulnerable library: cortx-ha/jenkins/pyinstaller/v1/requirements.txt

Dependency Hierarchy:

  • paramiko-2.7.1-py2.py3-none-any.whl (Root Library)
    • cryptography-2.8-cp34-abi3-manylinux2010_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 489a85b33aee06bc85dc7f2b7c71262cada47dd9

Found in base branch: main

Vulnerability Details

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

Publish Date: 2021-01-11

URL: CVE-2020-25659

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hggm-jpg3-v476

Release Date: 2020-09-17

Fix Resolution: 3.2

Improve installation path of setup-ees.yaml

@mssawant, @ajay-paratmandali, [CC: @saurabhkhanvilkar ]
Rename and move the file /opt/seagate/cortx/ha/conf/setup-ees.yaml to /opt/seagate/cortx/iostack-ha/conf/setup.yaml.

Also rename the contents as:

iostack-ha:
  post_install:
    script: /opt/seagate/cortx/ha/conf/script/build-ees-ha
    args:
      - --init
      - /var/lib/hare/cluster.yaml
      - /opt/seagate/cortx/ha/conf/build-ees-ha-args.yaml
  init:
    script: /opt/seagate/cortx/ha/conf/script/build-ees-ha
    args:
      - /var/lib/hare/cluster.yaml
      - /opt/seagate/cortx/ha/conf/build-ees-ha-args.yaml
  config:
    script: null
    args: null
  test:
    script: null
    args: null
  reset:
    script: /opt/seagate/cortx/ha/conf/script/prov-ha-reset
    args: null
  backup:
    files:
      - /var/lib/hare/build-ees-ha*-args.yaml
      - /var/lib/hare/cluster.yaml
      - /var/lib/hare/confd.*
      - /var/lib/hare/consul-*
      - /var/lib/hare/node-name
      - /var/lib/hare/hax-env-*
      - /etc/corosync/corosync.conf
  post_update:
    script: /opt/seagate/cortx/ha/conf/script/build-ees-ha-update
    args:
      - /var/lib/hare/cluster.yaml
      - /opt/seagate/cortx/ha/conf/build-ees-ha-args.yaml
      - /opt/seagate/cortx/ha/conf/build-ees-ha-csm-args.yaml
  remove_node:
    script: /opt/seagate/cortx/ha/conf/script/cluster_update
    args: remove_node
  add_node:
    script: /opt/seagate/cortx/ha/conf/script/cluster_update
    args: add_node

Justification:
It becomes easy for provisioner to identify setup.yaml as a name and have a separate component for iteration logic in batch processing.

CVE-2020-7212 (High) detected in urllib3-1.25.7-py2.py3-none-any.whl

CVE-2020-7212 - High Severity Vulnerability

Vulnerable Library - urllib3-1.25.7-py2.py3-none-any.whl

HTTP library with thread-safe connection pooling, file post, and more.

Library home page: https://files.pythonhosted.org/packages/b4/40/a9837291310ee1ccc242ceb6ebfd9eb21539649f193a7c8c86ba15b98539/urllib3-1.25.7-py2.py3-none-any.whl

Path to dependency file: cortx-ha/jenkins/pyinstaller/v1/requirements.txt

Path to vulnerable library: cortx-ha/jenkins/pyinstaller/v1/requirements.txt

Dependency Hierarchy:

  • python_consul-1.1.0-py2.py3-none-any.whl (Root Library)
    • requests-2.22.0-py2.py3-none-any.whl
      • urllib3-1.25.7-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 489a85b33aee06bc85dc7f2b7c71262cada47dd9

Found in base branch: main

Vulnerability Details

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).

Publish Date: 2020-03-06

URL: CVE-2020-7212

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hmv2-79q8-fv6g

Release Date: 2020-03-09

Fix Resolution: urllib3 - 1.25.8

build-ha-io script doesn't log anything

build-ha-io and group of similar scripts don't use logging at all. Instead all the messages are echo'ed to stdout that causes problems while investigating of deployment issues.

Solution: log messages to syslog.

Do we really need to copy: /etc/corosync/corosync.conf

- /etc/corosync/corosync.conf

Hi @saurabhkhanvilkar, @mssawant
During our discussion and troubleshooting, @ajay-paratmandali suggested this file needn't be copied as add_node script takes care of this.
Copying it again might lead to issues.

Also,
On

- /var/lib/hare/build-ees-ha*-args.yaml

Change /var/lib/hare/build-ees-ha*-args.yaml to  

/opt/seagate/cortx/ha/conf/build-ees-ha-args.yaml

CVE-2020-1747 (High) detected in PyYAML-5.1.2.tar.gz

CVE-2020-1747 - High Severity Vulnerability

Vulnerable Library - PyYAML-5.1.2.tar.gz

YAML parser and emitter for Python

Library home page: https://files.pythonhosted.org/packages/e3/e8/b3212641ee2718d556df0f23f78de8303f068fe29cdaa7a91018849582fe/PyYAML-5.1.2.tar.gz

Path to dependency file: cortx-ha/jenkins/pyinstaller/v1/requirements.txt

Path to vulnerable library: cortx-ha/jenkins/pyinstaller/v1/requirements.txt,cortx-ha/jenkins/pyinstaller/v2/requirements.txt

Dependency Hierarchy:

  • PyYAML-5.1.2.tar.gz (Vulnerable Library)

Found in HEAD commit: 489a85b33aee06bc85dc7f2b7c71262cada47dd9

Found in base branch: main

Vulnerability Details

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

Publish Date: 2020-03-24

URL: CVE-2020-1747

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6757-jp84-gxfx

Release Date: 2020-03-24

Fix Resolution: pyyaml - 5.3.1


⛑️ Automatic Remediation is available for this issue

CVE-2020-14422 (Medium) detected in ipaddress-1.0.23-py2.py3-none-any.whl

CVE-2020-14422 - Medium Severity Vulnerability

Vulnerable Library - ipaddress-1.0.23-py2.py3-none-any.whl

IPv4/IPv6 manipulation library

Library home page: https://files.pythonhosted.org/packages/c2/f8/49697181b1651d8347d24c095ce46c7346c37335ddc7d255833e7cde674d/ipaddress-1.0.23-py2.py3-none-any.whl

Path to dependency file: cortx-ha/jenkins/pyinstaller/requirements.txt

Path to vulnerable library: cortx-ha/jenkins/pyinstaller/requirements.txt

Dependency Hierarchy:

  • paramiko-2.7.1-py2.py3-none-any.whl (Root Library)
    • cryptography-2.8-cp27-cp27mu-manylinux2010_x86_64.whl
      • ipaddress-1.0.23-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 489a85b33aee06bc85dc7f2b7c71262cada47dd9

Found in base branch: main

Vulnerability Details

Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created. This is fixed in: v3.5.10, v3.5.10rc1; v3.6.12; v3.7.9; v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1; v3.9.0, v3.9.0b4, v3.9.0b5, v3.9.0rc1, v3.9.0rc2.

Publish Date: 2020-06-18

URL: CVE-2020-14422

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2020-14422

Release Date: 2020-06-18

Fix Resolution: 3.5.3-1+deb9u2, 3.7.3-2+deb10u2, 3.8.4~rc1-1


Step up your Open Source Security Game with WhiteSource here

CVE-2019-20477 (High) detected in PyYAML-5.1.2.tar.gz

CVE-2019-20477 - High Severity Vulnerability

Vulnerable Library - PyYAML-5.1.2.tar.gz

YAML parser and emitter for Python

Library home page: https://files.pythonhosted.org/packages/e3/e8/b3212641ee2718d556df0f23f78de8303f068fe29cdaa7a91018849582fe/PyYAML-5.1.2.tar.gz

Path to dependency file: cortx-ha/jenkins/pyinstaller/v1/requirements.txt

Path to vulnerable library: cortx-ha/jenkins/pyinstaller/v1/requirements.txt,cortx-ha/jenkins/pyinstaller/v2/requirements.txt

Dependency Hierarchy:

  • PyYAML-5.1.2.tar.gz (Vulnerable Library)

Found in HEAD commit: 489a85b33aee06bc85dc7f2b7c71262cada47dd9

Found in base branch: main

Vulnerability Details

PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.

Publish Date: 2020-02-19

URL: CVE-2019-20477

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20477

Release Date: 2020-02-19

Fix Resolution: 5.2


⛑️ Automatic Remediation is available for this issue

hctl status doesn't work properly with newer Pacemaker version

With the latest Pacemaker hctl node status --full reports about "starting" resources forever (although they seem to have been already started).

[root@sm21-r2 ~]# hctl node status --full|jq .
{
  "resources": {
    "statistics": {
      "started": 69,
      "stopped": 0,
      "starting": 2
    }
  }
  "nodes": [
    {
      "name": "srvnode-1",
      "online": true,
      "standby": false,
      "unclean": false,
      "resources_running": 39
    }
    {
      "name": "srvnode-2",
      "online": true,
      "standby": false,
      "unclean": false,
      "resources_running": 32
    }
  ]
}

pcs status output is as follows:

[root@sm21-r2 ~]# pcs status
Cluster name: cortx_cluster
Stack: corosync
Current DC: srvnode-1 (version 1.1.23-1.el7-9acf116022) - partition with quorum
Last updated: Wed Dec 23 04:20:48 2020
Last change: Tue Dec 22 12:25:25 2020 by root via cibadmin on srvnode-1
2 nodes configured
71 resource instances configured
Online: [ srvnode-1 srvnode-2 ]
Full list of resources:
 Clone Set: ClusterIP-clone [ClusterIP] (unique)
     ClusterIP:0      (ocf::heartbeat:IPaddr2):     Started srvnode-1
     ClusterIP:1      (ocf::heartbeat:IPaddr2):     Started srvnode-2
 stonith-c1   (stonith:fence_ipmilan):      Started srvnode-2
 stonith-c2   (stonith:fence_ipmilan):      Started srvnode-1
 Clone Set: lnet-clone [lnet]
     Started: [ srvnode-1 srvnode-2 ]
 Resource Group: c1
     ip-c1    (ocf::heartbeat:IPaddr2):     Started srvnode-1
     consul-c1(systemd:hare-consul-agent-c1): Started srvnode-1
     lnet-c1  (ocf::cortx:lnet):    Started srvnode-1
     var-motr1(ocf::heartbeat:Filesystem):  Started srvnode-1
     hax-c1   (systemd:hare-hax-c1):Started srvnode-1
     motr-confd-c1    (systemd:m0d@0x7200000000000001:0x9): Started srvnode-1
     motr-ios-c1      (systemd:m0d@0x7200000000000001:0xc): Started srvnode-1
     io_path_health-c1(ocf::seagate:hw_comp_ra):    Started srvnode-1
 Resource Group: c2
     ip-c2    (ocf::heartbeat:IPaddr2):     Started srvnode-2
     consul-c2(systemd:hare-consul-agent-c2): Started srvnode-2
     lnet-c2  (ocf::cortx:lnet):    Started srvnode-2
     var-motr2(ocf::heartbeat:Filesystem):  Started srvnode-2
     hax-c2   (systemd:hare-hax-c2):Started srvnode-2
     motr-confd-c2    (systemd:m0d@0x7200000000000001:0x52):Started srvnode-2
     motr-ios-c2      (systemd:m0d@0x7200000000000001:0x55):Started srvnode-2
     io_path_health-c2(ocf::seagate:hw_comp_ra):    Started srvnode-2
 Clone Set: motr-kernel-clone [motr-kernel]
     Started: [ srvnode-1 srvnode-2 ]
 motr-free-space-mon  (systemd:motr-free-space-monitor):    Started srvnode-1
 Clone Set: ldap-clone [ldap]
     Started: [ srvnode-1 srvnode-2 ]
 Clone Set: s3auth-clone [s3auth]
     Started: [ srvnode-1 srvnode-2 ]
 Clone Set: els-search-clone [els-search]
     Started: [ srvnode-1 srvnode-2 ]
 Clone Set: statsd-clone [statsd]
     Started: [ srvnode-1 srvnode-2 ]
 haproxy-c1   (systemd:haproxy):    Started srvnode-1
 haproxy-c2   (systemd:haproxy):    Started srvnode-2
 Clone Set: rabbitmq-clone [rabbitmq]
     Started: [ srvnode-1 srvnode-2 ]
 s3backcons-c1(systemd:s3backgroundconsumer): Started srvnode-1
 s3backcons-c2(systemd:s3backgroundconsumer): Started srvnode-2
 s3backprod   (systemd:s3backgroundproducer): Started srvnode-2
 s3server-c1-1(systemd:s3server@0x7200000000000001:0x22):   Started srvnode-1
 s3server-c1-2(systemd:s3server@0x7200000000000001:0x25):   Started srvnode-1
 s3server-c1-3(systemd:s3server@0x7200000000000001:0x28):   Started srvnode-1
 s3server-c1-4(systemd:s3server@0x7200000000000001:0x2b):   Started srvnode-1
 s3server-c1-5(systemd:s3server@0x7200000000000001:0x2e):   Started srvnode-1
 s3server-c1-6(systemd:s3server@0x7200000000000001:0x31):   Started srvnode-1
 s3server-c1-7(systemd:s3server@0x7200000000000001:0x34):   Started srvnode-1
 s3server-c1-8(systemd:s3server@0x7200000000000001:0x37):   Started srvnode-1
 s3server-c1-9(systemd:s3server@0x7200000000000001:0x3a):   Started srvnode-1
 s3server-c1-10 (systemd:s3server@0x7200000000000001:0x3d):   Started srvnode-1
 s3server-c1-11 (systemd:s3server@0x7200000000000001:0x40):   Started srvnode-1
 s3server-c2-1(systemd:s3server@0x7200000000000001:0x6b):   Started srvnode-2
 s3server-c2-2(systemd:s3server@0x7200000000000001:0x6e):   Started srvnode-2
 s3server-c2-3(systemd:s3server@0x7200000000000001:0x71):   Started srvnode-2
 s3server-c2-4(systemd:s3server@0x7200000000000001:0x74):   Started srvnode-2
 s3server-c2-5(systemd:s3server@0x7200000000000001:0x77):   Started srvnode-2
 s3server-c2-6(systemd:s3server@0x7200000000000001:0x7a):   Started srvnode-2
 s3server-c2-7(systemd:s3server@0x7200000000000001:0x7d):   Started srvnode-2
 s3server-c2-8(systemd:s3server@0x7200000000000001:0x80):   Started srvnode-2
 s3server-c2-9(systemd:s3server@0x7200000000000001:0x83):   Started srvnode-2
 s3server-c2-10 (systemd:s3server@0x7200000000000001:0x86):   Started srvnode-2
 s3server-c2-11 (systemd:s3server@0x7200000000000001:0x89):   Started srvnode-2
 Master/Slave Set: sspl-master [sspl]
     Masters: [ srvnode-1 ]
     Slaves: [ srvnode-2 ]
 Resource Group: csm-kibana
     kibana-vip (ocf::heartbeat:IPaddr2):     Started srvnode-1
     kibana   (systemd:kibana):     Started srvnode-1
     csm-web  (systemd:csm_web):    Started srvnode-1
     csm-agent(systemd:csm_agent):  Started srvnode-1
     mgmt_path_health-c1      (ocf::seagate:hw_comp_ra):    Started srvnode-1
 uds  (systemd:uds):Started srvnode-1
 sspl_primary_hw      (ocf::seagate:hw_comp_ra):    Started srvnode-1
Daemon Status:
  corosync: active/enabled
  pacemaker: active/enabled
  pcsd: active/enabled 

It seems like pcs status console output and/or pcs status xml has changed.

Here is the output of "pcs status full --xml": pcs_status.zip

The issue is discovered by @ypise

Refresh contex

  • Move config file logic from build_cortx_ha to ha_setup
  • Add logic to delete all keys stored in consul

Trivial Error in cortx-ha rpm creation in nested directory

I observed trivial error while building cortx-ha packages. If we clone cortx-ha in nested directory of multiple depth the rpm creation failed. We face this issue while creating OS wise nested folder for component build jobs. It's working fine with normal folder structure. So it's not blocking issue.

From investigation found that it's failing during Python virtual environment creation in pcswrap compilation phase. Steps to reproduce issue as as below,

Create multiple nested directory structure and clone cortx-ha repo

mkdir -p /tmp/workspace/GitHub-custom-ci-builds/custom_build_test/centos-7.8.2003
git clone https://github.com/Seagate/cortx-ha /tmp/workspace/GitHub-custom-ci-builds/custom_build_test/centos-7.8.2003/

Follow build steps,

./jenkins/build.sh -b 10

This script error out as,

+ make -C pcswrap install DESTDIR=/tmp/workspace/GitHub-custom-ci-builds/custom_build_test/centos-7.8.2003/dist/rpmbuild/BUILDROOT/cortx-ha-1.0.0-10_37b719e.x86_64/opt/seagate/cortx/ha
make: Entering directory `/tmp/workspace/GitHub-custom-ci-builds/custom_build_test/centos-7.8.2003/dist/rpmbuild/BUILD/cortx/pcswrap'
--> Initializing virtual env in /tmp/workspace/GitHub-custom-ci-builds/custom_build_test/centos-7.8.2003/dist/rpmbuild/BUILD/cortx/pcswrap/.py3venv
--> Installing pip modules in virtual env
bash: /tmp/workspace/GitHub-custom-ci-builds/custom_build_test/centos-7.8.2003/dist/rpmbuild/BUILD/cortx/pcswrap/.py3venv/bin/pip3: /tmp/workspace/GitHub-custom-ci-builds/custom_build_test/centos-7.8.2003/dist/: bad interpreter: No such file or directory
make: *** [/tmp/workspace/GitHub-custom-ci-builds/custom_build_test/centos-7.8.2003/dist/rpmbuild/BUILD/cortx/pcswrap/.py3venv] Error 126
make: Leaving directory `/tmp/workspace/GitHub-custom-ci-builds/custom_build_test/centos-7.8.2003/dist/rpmbuild/BUILD/cortx/pcswrap'
error: Bad exit status from /var/tmp/rpm-tmp.55IHqB (%install)


RPM build errors:
   Bad exit status from /var/tmp/rpm-tmp.55IHqB (%install)

Upgrade PyYAML package from PyYAML-5.1.2.tar.gz to PyYAML 5.4.1

This Bug is now used to upgrade PyYAML library from v 5.1.2 to 5.4.1

There are multiple vulnerabilities with following CVEs, 

 

CVE-2020-1747

CVE-2019-20477

CVE-2020-14343 

CVE-2019-20477

 

These vulnerabilities are expected to be fixed because of this upgrade

Description of sample vulnerability is mentioned below.


 

CVE-2020-14343 - High Severity Vulnerability

Vulnerable Library - PyYAML-5.1.2.tar.gz

YAML parser and emitter for Python

Library home page: [https://files.pythonhosted.org/packages/e3/e8/b3212641ee2718d556df0f23f78de8303f068fe29cdaa7a91018849582fe/PyYAML-5.1.2.tar.gz]

Path to dependency file: cortx-ha/jenkins/pyinstaller/v1/requirements.txt

Path to vulnerable library: cortx-ha/jenkins/pyinstaller/v1/requirements.txt,cortx-ha/jenkins/pyinstaller/v2/requirements.txt

Dependency Hierarchy:

  • PyYAML-5.1.2.tar.gz (Vulnerable Library)

Found in HEAD commit: 489a85b33aee06bc85dc7f2b7c71262cada47dd9

Found in base branch: main

Vulnerability Details

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.

Publish Date: 2021-02-09

URL: CVE-2020-14343

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
  • Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14343]

Release Date: 2021-02-09

Fix Resolution: PyYAML - 5.4


⛑️ Automatic Remediation is available for this issue

Copyright comments in XML files break XML parser

In commit f23882f copyright headers were added to all the files in the source code.

The problem is that "header" for XML files looks like this:

<!--

 Copyright (c) 2020 Seagate Technology LLC and/or its Affiliates

 This program is free software: you can redistribute it and/or modify it under the
 terms of the GNU Affero General Public License as published by the Free Software
 Foundation, either version 3 of the License, or (at your option) any later version.

 This program is distributed in the hope that it will be useful, but WITHOUT ANY
 WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
 PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.

 You should have received a copy of the GNU Affero General Public License along
 with this program. If not, see <https://www.gnu.org/licenses/>. For any questions
 about this software or licensing, please email [email protected] or
 [email protected].

-->

<?xml version="1.0"?>
<crm_mon version="1.1.20">
    <summary>
        <stack type="corosync" />

It makes XML invalid because XML document MUST start with <?xml > tag. This is required by the standard of XML format. Please also note that the XML files are sample data for unit tests. We simulate the output of pcs status full --xml command, so adding copyright there doesn't sound meaningful.

And having in mind that this is a part of unit tests, it seems like nobody runs them during cortx-ha build procedure. Because tests will obviously fail:

======================================================================
ERROR: test_unstandby_single_node_works (tests.test_cli_arguments.AppRunnerTest)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib64/python3.6/xml/etree/ElementTree.py", line 1624, in feed
    self.parser.Parse(data, 0)
xml.parsers.expat.ExpatError: XML or text declaration not at start of entity: line 20, column 0

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/720599/projects/cortx-ha/ha/pcswrap/pcswrap/internal/connector.py", line 165, in _parse_xml
    xml = ET.fromstring(xml_str)
  File "/home/720599/projects/cortx-ha/ha/pcswrap/.py3venv/lib64/python3.6/site-packages/defusedxml/common.py", line 131, in fromstring
    parser.feed(text)
  File "/usr/lib64/python3.6/xml/etree/ElementTree.py", line 1626, in feed
    self._raiseerror(v)
  File "/usr/lib64/python3.6/xml/etree/ElementTree.py", line 1525, in _raiseerror
    raise err
  File "<string>", line None
xml.etree.ElementTree.ParseError: XML or text declaration not at start of entity: line 20, column 0

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/720599/projects/cortx-ha/ha/pcswrap/tests/test_cli_arguments.py", line 102, in test_unstandby_single_node_works
    stub_client, runner = self._create_client_and_runner()
  File "/home/720599/projects/cortx-ha/ha/pcswrap/tests/test_cli_arguments.py", line 69, in _create_client_and_runner
    stub_client = Client(connector=connector)
  File "/home/720599/projects/cortx-ha/ha/pcswrap/pcswrap/client.py", line 68, in __init__
    self._ensure_sane()
  File "/home/720599/projects/cortx-ha/ha/pcswrap/pcswrap/client.py", line 71, in _ensure_sane
    self.connector.get_nodes()
  File "/home/720599/projects/cortx-ha/ha/pcswrap/pcswrap/internal/connector.py", line 146, in get_nodes
    xml = self._parse_xml(xml_str)
  File "/home/720599/projects/cortx-ha/ha/pcswrap/pcswrap/internal/connector.py", line 168, in _parse_xml
    raise PcsNoStatusException('Broken XML was given')
pcswrap.exception.PcsNoStatusException: Broken XML was given

----------------------------------------------------------------------
Ran 23 tests in 0.022s

FAILED (errors=16)
Test failed: <unittest.runner.TextTestResult run=23 errors=16 failures=0>
error: Test failed: <unittest.runner.TextTestResult run=23 errors=16 failures=0>

Suggested solution:

  • Remove "header" from XML files in unit tests. It is not Seagate who invented those XMLs anyway.

cc @johnbent, @ajaysrivas

Use salt command to get faulty node

node_list=$(salt-call --local pillar.get cluster:node_list --output=json)

salt-call pillar.get cluster:replace_node:minion_id --out=json
{
    "local": "srvnode-2"
}
[root@ssc-vm-c-0464 ~]# salt 'srvnode-2' grains.get node_id --out=json
{
    "srvnode-2": "490f37bd-d321-4cf5-b7d5-e2b1508de8d7"
}

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.