Giter Club home page Giter Club logo

seagate / cortx-rgw Goto Github PK

View Code? Open in Web Editor NEW

This project forked from ceph/ceph

5.0 3.0 32.0 579.81 MB

Ceph is a distributed object, block, and file storage platform. This repo is a fork of that repo that the CORTX community uses to stage our changes for the purposes of creating and maintaining a motr SAL backend for RGW.

Home Page: https://github.com/Seagate/cortx

License: Other

C++ 64.90% Shell 3.11% Python 13.61% CMake 0.99% Makefile 0.01% C 5.44% Perl 0.69% HTML 0.80% CSS 0.01% JavaScript 0.21% Assembly 0.07% Java 0.13% DIGITAL Command Language 0.01% Lua 0.01% Roff 0.04% TypeScript 3.71% Dockerfile 0.01% Raku 6.24% SWIG 0.01% SCSS 0.06%

cortx-rgw's Introduction

Disclaimer: This project is not maintained anymore

Ceph - a scalable distributed storage system

Please see http://ceph.com/ for current info.

Contributing Code

Most of Ceph is dual licensed under the LGPL version 2.1 or 3.0. Some miscellaneous code is under a BSD-style license or is public domain. The documentation is licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0). There are a handful of headers included here that are licensed under the GPL. Please see the file COPYING for a full inventory of licenses by file.

Code contributions must include a valid "Signed-off-by" acknowledging the license for the modified or contributed file. Please see the file SubmittingPatches.rst for details on what that means and on how to generate and submit patches.

We do not require assignment of copyright to contribute code; code is contributed under the terms of the applicable license.

Checking out the source

You can clone from github with

git clone [email protected]:ceph/ceph

or, if you are not a github user,

git clone git://github.com/ceph/ceph

Ceph contains many git submodules that need to be checked out with

git submodule update --init --recursive

Build Prerequisites

The list of Debian or RPM packages dependencies can be installed with:

./install-deps.sh

Building Ceph

Note that these instructions are meant for developers who are compiling the code for development and testing. To build binaries suitable for installation we recommend you build deb or rpm packages or refer to the ceph.spec.in or debian/rules to see which configuration options are specified for production builds.

Build instructions:

./do_cmake.sh
cd build
ninja

(do_cmake.sh now defaults to creating a debug build of ceph that can be up to 5x slower with some workloads. Please pass "-DCMAKE_BUILD_TYPE=RelWithDebInfo" to do_cmake.sh to create a non-debug release.

The number of jobs used by ninja is derived from the number of CPU cores of the building host if unspecified. Use the -j option to limit the job number if the build jobs are running out of memory. On average, each job takes around 2.5GiB memory.)

This assumes you make your build dir a subdirectory of the ceph.git checkout. If you put it elsewhere, just point CEPH_GIT_DIR to the correct path to the checkout. Any additional CMake args can be specified by setting ARGS before invoking do_cmake. See cmake options for more details. Eg.

ARGS="-DCMAKE_C_COMPILER=gcc-7" ./do_cmake.sh

To build only certain targets use:

ninja [target name]

To install:

ninja install

CMake Options

If you run the cmake command by hand, there are many options you can set with "-D". For example, the option to build the RADOS Gateway is defaulted to ON. To build without the RADOS Gateway:

cmake -DWITH_RADOSGW=OFF [path to top-level ceph directory]

Another example below is building with debugging and alternate locations for a couple of external dependencies:

cmake -DLEVELDB_PREFIX="/opt/hyperleveldb" \
-DCMAKE_INSTALL_PREFIX=/opt/ceph -DCMAKE_C_FLAGS="-Og -g3 -gdwarf-4" \
..

To view an exhaustive list of -D options, you can invoke cmake with:

cmake -LH

If you often pipe ninja to less and would like to maintain the diagnostic colors for errors and warnings (and if your compiler supports it), you can invoke cmake with:

cmake -DDIAGNOSTICS_COLOR=always ...

Then you'll get the diagnostic colors when you execute:

ninja | less -R

Other available values for 'DIAGNOSTICS_COLOR' are 'auto' (default) and 'never'.

Building a source tarball

To build a complete source tarball with everything needed to build from source and/or build a (deb or rpm) package, run

./make-dist

This will create a tarball like ceph-$version.tar.bz2 from git. (Ensure that any changes you want to include in your working directory are committed to git.)

Running a test cluster

To run a functional test cluster,

cd build
ninja vstart        # builds just enough to run vstart
../src/vstart.sh --debug --new -x --localhost --bluestore
./bin/ceph -s

Almost all of the usual commands are available in the bin/ directory. For example,

./bin/rados -p rbd bench 30 write
./bin/rbd create foo --size 1000

To shut down the test cluster,

../src/stop.sh

To start or stop individual daemons, the sysvinit script can be used:

./bin/init-ceph restart osd.0
./bin/init-ceph stop

Running unit tests

To build and run all tests (in parallel using all processors), use ctest:

cd build
ninja
ctest -j$(nproc)

(Note: Many targets built from src/test are not run using ctest. Targets starting with "unittest" are run in ninja check and thus can be run with ctest. Targets starting with "ceph_test" can not, and should be run by hand.)

When failures occur, look in build/Testing/Temporary for logs.

To build and run all tests and their dependencies without other unnecessary targets in Ceph:

cd build
ninja check -j$(nproc)

To run an individual test manually, run ctest with -R (regex matching):

ctest -R [regex matching test name(s)]

(Note: ctest does not build the test it's running or the dependencies needed to run it)

To run an individual test manually and see all the tests output, run ctest with the -V (verbose) flag:

ctest -V -R [regex matching test name(s)]

To run tests manually and run the jobs in parallel, run ctest with the -j flag:

ctest -j [number of jobs]

There are many other flags you can give ctest for better control over manual test execution. To view these options run:

man ctest

Building the Documentation

Prerequisites

The list of package dependencies for building the documentation can be found in doc_deps.deb.txt:

sudo apt-get install `cat doc_deps.deb.txt`

Building the Documentation

To build the documentation, ensure that you are in the top-level /ceph directory, and execute the build script. For example:

admin/build-doc

Reporting Issues

To report an issue and view existing issues, please visit https://tracker.ceph.com/projects/ceph.

cortx-rgw's People

Stargazers

 avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar

cortx-rgw's Issues

CVE-2021-43138 (High) detected in async-2.6.3.tgz - autoclosed

CVE-2021-43138 - High Severity Vulnerability

Vulnerable Library - async-2.6.3.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.3.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/async/package.json

Dependency Hierarchy:

  • build-angular-12.2.13.tgz (Root Library)
    • webpack-dev-server-3.11.2.tgz
      • portfinder-1.0.28.tgz
        • async-2.6.3.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (@angular-devkit/build-angular): 13.3.3


⛑️ Automatic Remediation is available for this issue

CVE-2020-11022 (Medium) detected in jquery-1.8.3.js

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.3.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.3/jquery.js

Path to dependency file: /qa/workunits/erasure-code/bench.html

Path to vulnerable library: /qa/workunits/erasure-code/jquery.js,/qa/workunits/erasure-code/jquery.js

Dependency Hierarchy:

  • jquery-1.8.3.js (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

CVE-2022-23647 (Medium) detected in prismjs-1.25.0.tgz - autoclosed

CVE-2022-23647 - Medium Severity Vulnerability

Vulnerable Library - prismjs-1.25.0.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.25.0.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/prismjs/package.json

Dependency Hierarchy:

  • swagger-ui-4.1.3.tgz (Root Library)
    • react-syntax-highlighter-15.4.5.tgz
      • prismjs-1.25.0.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use the command line plugin.

Publish Date: 2022-02-18

URL: CVE-2022-23647

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3949-f494-cm99

Release Date: 2022-02-18

Fix Resolution (prismjs): 1.27.0

Direct dependency fix Resolution (swagger-ui): 4.2.0


⛑️ Automatic Remediation is available for this issue

CVE-2021-23648 (Medium) detected in sanitize-url-5.0.2.tgz

CVE-2021-23648 - Medium Severity Vulnerability

Vulnerable Library - sanitize-url-5.0.2.tgz

A url sanitizer

Library home page: https://registry.npmjs.org/@braintree/sanitize-url/-/sanitize-url-5.0.2.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/@braintree/sanitize-url/package.json

Dependency Hierarchy:

  • swagger-ui-4.1.3.tgz (Root Library)
    • sanitize-url-5.0.2.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.

Publish Date: 2022-03-16

URL: CVE-2021-23648

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23648

Release Date: 2022-03-16

Fix Resolution (@braintree/sanitize-url): 6.0.0

Direct dependency fix Resolution (swagger-ui): 4.7.0


⛑️ Automatic Remediation is available for this issue

Watch-notify mechanism for metadata cache to be supported

Currently the metadata cache is implemented based on expiry time. There exists a window in which an object has been updated (for example, resized, deleted etc. ) but the cached metadata items in other instances haven't expired yet, resulting invalid metadata been returned. Watch-notify is to register a callback function (watch) on an object, when there is any update on the watched object in one rgw instance, a notification will be sent to other instances to update corresponding cache items. Motr FDMI will be explored to implement this watch-notify mechanism.

There may be other user cases for watch-notify mechanism.

CVE-2022-0691 (High) detected in url-parse-1.5.4.tgz - autoclosed

CVE-2022-0691 - High Severity Vulnerability

Vulnerable Library - url-parse-1.5.4.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.5.4.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/url-parse/package.json

Dependency Hierarchy:

  • swagger-ui-4.1.3.tgz (Root Library)
    • url-parse-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

Publish Date: 2022-02-21

URL: CVE-2022-0691

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691

Release Date: 2022-02-21

Fix Resolution (url-parse): 1.5.9

Direct dependency fix Resolution (swagger-ui): 4.2.0


⛑️ Automatic Remediation is available for this issue

CVE-2020-7656 (Medium) detected in jquery-1.8.3.js

CVE-2020-7656 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.3.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.3/jquery.js

Path to dependency file: /qa/workunits/erasure-code/bench.html

Path to vulnerable library: /qa/workunits/erasure-code/jquery.js,/qa/workunits/erasure-code/jquery.js

Dependency Hierarchy:

  • jquery-1.8.3.js (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Publish Date: 2020-05-19

URL: CVE-2020-7656

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q4m3-2j7h-f7xw

Release Date: 2020-05-28

Fix Resolution: jquery - 1.9.0

UploadPartCopy API needs to be supported

╰─➤ aws s3api upload-part --bucket mybucket2 --key mp30Mbfile --upload-id "2~9auEDojyc2knsOqxz3Ep3ME4_TKOj45" --part-number 2 --body ~/10Mbfile
{
"ETag": "\"f1c9645dbc14efddc7d8a322685f26eb\""
}


╰─➤ aws s3api upload-part-copy --bucket mybucket2 --key mp30Mbfile --upload-id "2~9auEDojyc2knsOqxz3Ep3ME4_TKOj45" --part-number 3 --copy-source mybucket1/obj1

Could not connect to the endpoint URL: "http://localhost:8000/mybucket2/mp30Mbfile?partNumber=3&uploadId=2~9auEDojyc2knsOqxz3Ep3ME4_TKOj45"

In the multipart session, UploadPart API works fine but UploadPartCopy does not get to completion resulting in the unavailability of the RGW endpoint.

Possible memleak on PUT in case of checksum failure

Currently, the MotrAtomicWriter::cleanup() is called on MotrAtomicWriter::commit() which may not be called at all in case of a checksum failure, for example:

  if (supplied_etag && etag.compare(supplied_etag) != 0) {
    op_ret = -ERR_UNPROCESSABLE_ENTITY;
    return;
  }

src/rgw/rgw_op.cc:4157

In which case, there will be a memory leak.

Suggested solution: from src/rgw/rgw_op.cc:

4076     op_ret = filter->process(std::move(data), ofs);
4077     if (op_ret < 0) {
4078       ldpp_dout(this, 20) << "processor->process() returned ret="
4079           << op_ret << dendl;
4080       return;
4081     }
4082 
4083     ofs += len;
4084   } while (len > 0);
4085   tracepoint(rgw_op, after_data_transfer, s->req_id.c_str(), ofs);
4086 
4087   // flush any data in filters
4088   op_ret = filter->process({}, ofs);
4089   if (op_ret < 0) {
4090     return;
4091   } 

process() is called with zero data at the end of the loop, so we can use it to call cleanup().

CVE-2020-7608 (Medium) detected in yargs-parser-9.0.2.tgz

CVE-2020-7608 - Medium Severity Vulnerability

Vulnerable Library - yargs-parser-9.0.2.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-9.0.2.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/htmllint-cli/node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • htmllint-cli-0.0.7.tgz (Root Library)
    • yargs-11.1.1.tgz
      • yargs-parser-9.0.2.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: yargs/yargs-parser@63810ca

Release Date: 2020-03-16

Fix Resolution: 5.0.1;13.1.2;15.0.1;18.1.1

CVE-2022-24303 (High) detected in Pillow-9.0.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl - autoclosed

CVE-2022-24303 - High Severity Vulnerability

Vulnerable Library - Pillow-9.0.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

Python Imaging Library (Fork)

Library home page: https://files.pythonhosted.org/packages/65/c5/85054edda7adce1e9444db026fb1972d81718b1605d0eddda94a6be0709f/Pillow-9.0.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl

Path to dependency file: /src/pybind/rados

Path to vulnerable library: /src/pybind/rados,/src/tools/cephfs/top,/src/tools/cephfs,/src/pybind/cephfs,/src/ceph-volume

Dependency Hierarchy:

  • Pillow-9.0.0-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.

Publish Date: 2022-03-28

URL: CVE-2022-24303

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9j59-75qj-795w

Release Date: 2022-03-28

Fix Resolution: Pillow - 9.0.1


⛑️ Automatic Remediation is available for this issue

CVE-2022-0536 (Medium) detected in follow-redirects-1.14.6.tgz - autoclosed

CVE-2022-0536 - Medium Severity Vulnerability

Vulnerable Library - follow-redirects-1.14.6.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.6.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • start-server-and-test-1.12.1.tgz (Root Library)
    • wait-on-5.3.0.tgz
      • axios-0.21.4.tgz
        • follow-redirects-1.14.6.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution (follow-redirects): 1.14.8

Direct dependency fix Resolution (start-server-and-test): 1.12.2


⛑️ Automatic Remediation is available for this issue

S3 objects write atomicity to be fixed

Currently, if the same S3 object is written concurrently by several processes - it may end up with mixed data. But S3 API requires that the resulting object data should be consistent either with one or another version. This must be fixed.

The simplest way to fix it is to always generate the new FID for Motr objects and update the bucket index with the new FID upon the write completion. There is a function in Motr API to generate unique FIDs which can be used for this. (Note: GC should be involved to delete the object data which did not end up being written.)

CVE-2021-23567 (High) detected in colors-1.4.0.tgz

CVE-2021-23567 - High Severity Vulnerability

Vulnerable Library - colors-1.4.0.tgz

get colors in your node.js console

Library home page: https://registry.npmjs.org/colors/-/colors-1.4.0.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/colors/package.json,/src/pybind/mgr/dashboard/frontend/node_modules/@compodoc/live-server/node_modules/colors/package.json

Dependency Hierarchy:

  • compodoc-1.1.16.tgz (Root Library)
    • colors-1.4.0.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0

Publish Date: 2022-01-14

URL: CVE-2021-23567

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2021-23566 (Medium) detected in nanoid-3.1.30.tgz

CVE-2021-23566 - Medium Severity Vulnerability

Vulnerable Library - nanoid-3.1.30.tgz

A tiny (130 bytes), secure URL-friendly unique string ID generator

Library home page: https://registry.npmjs.org/nanoid/-/nanoid-3.1.30.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/nanoid/package.json

Dependency Hierarchy:

  • build-angular-12.2.13.tgz (Root Library)
    • postcss-8.3.6.tgz
      • nanoid-3.1.30.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

The package nanoid before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

Publish Date: 2022-01-14

URL: CVE-2021-23566

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23566

Release Date: 2022-01-14

Fix Resolution: nanoid - 3.1.31

CVE-2018-1128 (High) detected in multiple libraries

CVE-2018-1128 - High Severity Vulnerability

Vulnerable Libraries - cephf3a4166379b12d4a7bba667fe761e5b660552db1, cephf3a4166379b12d4a7bba667fe761e5b660552db1, cephf3a4166379b12d4a7bba667fe761e5b660552db1, cephf3a4166379b12d4a7bba667fe761e5b660552db1, cephf3a4166379b12d4a7bba667fe761e5b660552db1, cephf3a4166379b12d4a7bba667fe761e5b660552db1, cephf3a4166379b12d4a7bba667fe761e5b660552db1

Vulnerability Details

It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.

Publish Date: 2018-07-10

URL: CVE-2018-1128

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Adjacent
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/ceph/ceph/tree/v14.0.1

Release Date: 2018-07-10

Fix Resolution: v14.0.1

CVE-2020-28469 (High) detected in glob-parent-3.1.0.tgz

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Library - glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/webpack-dev-server/node_modules/glob-parent/package.json

Dependency Hierarchy:

  • build-angular-12.2.13.tgz (Root Library)
    • webpack-dev-server-3.11.2.tgz
      • chokidar-2.1.8.tgz
        • glob-parent-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution: glob-parent - 5.1.2

CVE-2015-9251 (Medium) detected in jquery-1.8.3.js

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.3.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.3/jquery.js

Path to dependency file: /qa/workunits/erasure-code/bench.html

Path to vulnerable library: /qa/workunits/erasure-code/jquery.js,/qa/workunits/erasure-code/jquery.js

Dependency Hierarchy:

  • jquery-1.8.3.js (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0

CVE-2021-3749 (High) detected in axios-0.21.1.tgz

CVE-2021-3749 - High Severity Vulnerability

Vulnerable Library - axios-0.21.1.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.21.1.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/@applitools/eyes-sdk-core/node_modules/axios/package.json

Dependency Hierarchy:

  • eyes-cypress-3.22.0.tgz (Root Library)
    • visual-grid-client-15.8.7.tgz
      • eyes-sdk-core-12.20.0.tgz
        • axios-0.21.1.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

axios is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-08-31

URL: CVE-2021-3749

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/axios/axios/releases/tag/v0.21.2

Release Date: 2021-08-31

Fix Resolution: axios - 0.21.2

CVE-2022-21680 (Medium) detected in marked-3.0.8.tgz

CVE-2022-21680 - Medium Severity Vulnerability

Vulnerable Library - marked-3.0.8.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-3.0.8.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/marked/package.json

Dependency Hierarchy:

  • compodoc-1.1.15.tgz (Root Library)
    • marked-3.0.8.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression block.def may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

Publish Date: 2022-01-14

URL: CVE-2022-21680

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rrrm-qjm4-v8hf

Release Date: 2022-01-14

Fix Resolution: marked - 4.0.10

CVE-2021-3807 (High) detected in ansi-regex-4.1.0.tgz, ansi-regex-3.0.0.tgz

CVE-2021-3807 - High Severity Vulnerability

Vulnerable Libraries - ansi-regex-4.1.0.tgz, ansi-regex-3.0.0.tgz

ansi-regex-4.1.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/webpack-dev-server/node_modules/string-width/node_modules/ansi-regex/package.json,/src/pybind/mgr/dashboard/frontend/node_modules/webpack-dev-server/node_modules/wrap-ansi/node_modules/ansi-regex/package.json,/src/pybind/mgr/dashboard/frontend/node_modules/webpack-dev-server/node_modules/cliui/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • build-angular-12.2.13.tgz (Root Library)
    • webpack-dev-server-3.11.2.tgz
      • yargs-13.3.2.tgz
        • string-width-3.1.0.tgz
          • strip-ansi-5.2.0.tgz
            • ansi-regex-4.1.0.tgz (Vulnerable Library)
ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/htmllint-cli/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • htmllint-cli-0.0.7.tgz (Root Library)
    • yargs-11.1.1.tgz
      • cliui-4.1.0.tgz
        • strip-ansi-4.0.0.tgz
          • ansi-regex-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution: ansi-regex - 5.0.1,6.0.1

CVE-2022-24771 (High) detected in node-forge-0.10.0.tgz

CVE-2022-24771 - High Severity Vulnerability

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/node-forge/package.json

Dependency Hierarchy:

  • build-angular-12.2.13.tgz (Root Library)
    • webpack-dev-server-3.11.2.tgz
      • selfsigned-1.10.11.tgz
        • node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24771

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@angular-devkit/build-angular): 13.3.3


⛑️ Automatic Remediation is available for this issue

CVE-2022-24772 (High) detected in node-forge-0.10.0.tgz

CVE-2022-24772 - High Severity Vulnerability

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/node-forge/package.json

Dependency Hierarchy:

  • build-angular-12.2.13.tgz (Root Library)
    • webpack-dev-server-3.11.2.tgz
      • selfsigned-1.10.11.tgz
        • node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24772

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@angular-devkit/build-angular): 13.3.3


⛑️ Automatic Remediation is available for this issue

CVE-2022-24785 (High) detected in moment-2.29.1.tgz - autoclosed

CVE-2022-24785 - High Severity Vulnerability

Vulnerable Library - moment-2.29.1.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.29.1.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/moment/package.json

Dependency Hierarchy:

  • moment-2.29.1.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Publish Date: 2022-04-04

URL: CVE-2022-24785

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8hfj-j24r-96c4

Release Date: 2022-04-04

Fix Resolution: 2.29.2


⛑️ Automatic Remediation is available for this issue

CVE-2022-0155 (Medium) detected in follow-redirects-1.14.6.tgz

CVE-2022-0155 - Medium Severity Vulnerability

Vulnerable Library - follow-redirects-1.14.6.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.6.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • start-server-and-test-1.12.1.tgz (Root Library)
    • wait-on-5.3.0.tgz
      • axios-0.21.4.tgz
        • follow-redirects-1.14.6.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution: follow-redirects - v1.14.7

CVE-2021-34141 (Medium) detected in numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl

CVE-2021-34141 - Medium Severity Vulnerability

Vulnerable Library - numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl

NumPy is the fundamental package for array computing with Python.

Library home page: https://files.pythonhosted.org/packages/1a/2e/4e298c92b1fced64a4414ada9af3253a91083b92b131c2b10c057c507982/numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl

Path to dependency file: /src/pybind/mgr/diskprediction_local/requirements.txt

Path to vulnerable library: /src/pybind/mgr/diskprediction_local/requirements.txt,/src/pybind/rgw,/src/pybind/rbd

Dependency Hierarchy:

  • numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: b7c0ec1e6a9bc4b3d908a672c3a8228bdb8dfbd0

Vulnerability Details

An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."

Publish Date: 2021-12-17

URL: CVE-2021-34141

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-34141

Release Date: 2021-12-17

Fix Resolution: numpy - 1.22.0rc1,1.12.0b1;numpy-base - 1.16.2;numpy - 1.13.2,1.17.4;albatradis - 1.0.1

CVE-2021-33430 (High) detected in numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl

CVE-2021-33430 - High Severity Vulnerability

Vulnerable Library - numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl

NumPy is the fundamental package for array computing with Python.

Library home page: https://files.pythonhosted.org/packages/1a/2e/4e298c92b1fced64a4414ada9af3253a91083b92b131c2b10c057c507982/numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl

Path to dependency file: /src/pybind/mgr/diskprediction_local/requirements.txt

Path to vulnerable library: /src/pybind/mgr/diskprediction_local/requirements.txt,/src/pybind/rgw,/src/pybind/rbd

Dependency Hierarchy:

  • numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: b7c0ec1e6a9bc4b3d908a672c3a8228bdb8dfbd0

Vulnerability Details

A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service.

Publish Date: 2021-12-17

URL: CVE-2021-33430

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-33430

Release Date: 2021-12-17

Fix Resolution: numpy - 1.21.0

CVE-2022-21681 (Medium) detected in marked-3.0.8.tgz

CVE-2022-21681 - Medium Severity Vulnerability

Vulnerable Library - marked-3.0.8.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-3.0.8.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/marked/package.json

Dependency Hierarchy:

  • compodoc-1.1.15.tgz (Root Library)
    • marked-3.0.8.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

Publish Date: 2022-01-14

URL: CVE-2022-21681

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5v2h-r2cx-5xgj

Release Date: 2022-01-14

Fix Resolution: marked - 4.0.10

WS-2022-0008 (Medium) detected in node-forge-0.10.0.tgz

WS-2022-0008 - Medium Severity Vulnerability

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/node-forge/package.json

Dependency Hierarchy:

  • build-angular-12.2.13.tgz (Root Library)
    • webpack-dev-server-3.11.2.tgz
      • selfsigned-1.10.11.tgz
        • node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Publish Date: 2022-01-08

URL: WS-2022-0008

CVSS 3 Score Details (6.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5rrq-pxf6-6jx5

Release Date: 2022-01-08

Fix Resolution: node-forge - 1.0.0

CVE-2022-0235 (Medium) detected in node-fetch-2.6.1.tgz

CVE-2022-0235 - Medium Severity Vulnerability

Vulnerable Library - node-fetch-2.6.1.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/node-fetch/package.json

Dependency Hierarchy:

  • eyes-cypress-3.22.5.tgz (Root Library)
    • visual-grid-client-15.8.31.tgz
      • isomorphic-fetch-3.0.0.tgz
        • node-fetch-2.6.1.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Publish Date: 2022-01-16

URL: CVE-2022-0235

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2022-0639 (Medium) detected in url-parse-1.5.4.tgz - autoclosed

CVE-2022-0639 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.5.4.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.5.4.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/url-parse/package.json

Dependency Hierarchy:

  • swagger-ui-4.1.3.tgz (Root Library)
    • url-parse-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: 88df34b8503111374813cd51c3e6e503f5c24315

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.

Publish Date: 2022-02-17

URL: CVE-2022-0639

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0639

Release Date: 2022-02-17

Fix Resolution: url-parse - 1.5.7

CVE-2022-1214 (High) detected in axios-0.21.4.tgz - autoclosed

CVE-2022-1214 - High Severity Vulnerability

Vulnerable Library - axios-0.21.4.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.21.4.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/axios/package.json

Dependency Hierarchy:

  • start-server-and-test-1.12.1.tgz (Root Library)
    • wait-on-5.3.0.tgz
      • axios-0.21.4.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository axios/axios prior to 0.26.

Publish Date: 2022-05-03

URL: CVE-2022-1214

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/ef7b4ab6-a3f6-4268-a21a-e7104d344607/

Release Date: 2022-05-03

Fix Resolution: axios - v0.26.0

WS-2021-0461 (Medium) detected in swagger-ui-4.1.2.tgz

WS-2021-0461 - Medium Severity Vulnerability

Vulnerable Library - swagger-ui-4.1.2.tgz

[![NPM version](https://badge.fury.io/js/swagger-ui.svg)](http://badge.fury.io/js/swagger-ui) [![Build Status](https://jenkins.swagger.io/view/OSS%20-%20JavaScript/job/oss-swagger-ui-master/badge/icon?subject=jenkins%20build)](https://jenkins.swagger.io/v

Library home page: https://registry.npmjs.org/swagger-ui/-/swagger-ui-4.1.2.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/swagger-ui/package.json

Dependency Hierarchy:

  • swagger-ui-4.1.2.tgz (Vulnerable Library)

Found in HEAD commit: d70fdd74b993610fb0ff26c0a96e040ffa3ddaba

Vulnerability Details

SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users often want to see what their OpenAPI definitions would look like rendered.

However, this functionality may pose a risk for users who host their own SwaggerUI instances. In particular, including remote OpenAPI definitions opens a vector for phishing attacks by abusing the trusted names/domains of self-hosted instances.

Resolution:
We've made the decision to disable query parameters (ceph#4872) by default starting with SwaggerUI version 4.1.3. Please update to this version when it becomes available (ETA: 2021 December). Users will still be able to be re-enable the options at their discretion. We'll continue to enable query parameters on the Swagger demo sites.

Publish Date: 2021-12-09

URL: WS-2021-0461

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qrmm-w75w-3wpx

Release Date: 2021-12-09

Fix Resolution: swagger-ui - 4.1.3;swagger-ui-dist - 4.1.3

CVE-2019-6446 (High) detected in numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl

CVE-2019-6446 - High Severity Vulnerability

Vulnerable Library - numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl

NumPy is the fundamental package for array computing with Python.

Library home page: https://files.pythonhosted.org/packages/1a/2e/4e298c92b1fced64a4414ada9af3253a91083b92b131c2b10c057c507982/numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl

Path to dependency file: /src/pybind/mgr/diskprediction_local/requirements.txt

Path to vulnerable library: /src/pybind/mgr/diskprediction_local/requirements.txt,/src/pybind/rgw,/src/pybind/rbd

Dependency Hierarchy:

  • numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

** DISPUTED ** An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.

Publish Date: 2019-01-16

URL: CVE-2019-6446

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1859

Release Date: 2019-10-01

Fix Resolution: 1.16.2

CVE-2020-11023 (Medium) detected in jquery-1.8.3.js

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.3.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.3/jquery.js

Path to dependency file: /qa/workunits/erasure-code/bench.html

Path to vulnerable library: /qa/workunits/erasure-code/jquery.js,/qa/workunits/erasure-code/jquery.js

Dependency Hierarchy:

  • jquery-1.8.3.js (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

CVE-2022-0122 (Medium) detected in node-forge-0.10.0.tgz

CVE-2022-0122 - Medium Severity Vulnerability

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/node-forge/package.json

Dependency Hierarchy:

  • build-angular-12.2.13.tgz (Root Library)
    • webpack-dev-server-3.11.2.tgz
      • selfsigned-1.10.11.tgz
        • node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

forge is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2022-01-06

URL: CVE-2022-0122

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gf8q-jrpm-jvxq

Release Date: 2022-01-06

Fix Resolution: node-forge - 1.0.0

CVE-2021-44906 (High) detected in minimist-1.2.5.tgz

CVE-2021-44906 - High Severity Vulnerability

Vulnerable Library - minimist-1.2.5.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/minimist/package.json

Dependency Hierarchy:

  • compiler-cli-12.2.13.tgz (Root Library)
    • minimist-1.2.5.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/substack/minimist/issues/164

Release Date: 2022-03-17

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (@angular/compiler-cli): 13.3.3


⛑️ Automatic Remediation is available for this issue

CVE-2021-41496 (High) detected in numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl

CVE-2021-41496 - High Severity Vulnerability

Vulnerable Library - numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl

NumPy is the fundamental package for array computing with Python.

Library home page: https://files.pythonhosted.org/packages/1a/2e/4e298c92b1fced64a4414ada9af3253a91083b92b131c2b10c057c507982/numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl

Path to dependency file: /src/pybind/mgr/diskprediction_local/requirements.txt

Path to vulnerable library: /src/pybind/mgr/diskprediction_local/requirements.txt,/src/pybind/rgw,/src/pybind/rbd

Dependency Hierarchy:

  • numpy-1.15.1-cp37-cp37m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: b7c0ec1e6a9bc4b3d908a672c3a8228bdb8dfbd0

Vulnerability Details

Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values.

Publish Date: 2021-12-17

URL: CVE-2021-41496

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-41496

Release Date: 2021-12-17

Fix Resolution: autovizwidget - 0.12.7;numpy - 1.22.0rc1;numcodecs - 0.6.2;numpy-base - 1.11.3;numpy - 1.17.4

CVE-2022-0686 (High) detected in url-parse-1.5.4.tgz - autoclosed

CVE-2022-0686 - High Severity Vulnerability

Vulnerable Library - url-parse-1.5.4.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.5.4.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/url-parse/package.json

Dependency Hierarchy:

  • swagger-ui-4.1.3.tgz (Root Library)
    • url-parse-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

Publish Date: 2022-02-20

URL: CVE-2022-0686

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0686

Release Date: 2022-02-20

Fix Resolution (url-parse): 1.5.8

Direct dependency fix Resolution (swagger-ui): 4.2.0


⛑️ Automatic Remediation is available for this issue

CVE-2021-23424 (High) detected in ansi-html-0.0.7.tgz

CVE-2021-23424 - High Severity Vulnerability

Vulnerable Library - ansi-html-0.0.7.tgz

An elegant lib that converts the chalked (ANSI) text to HTML.

Library home page: https://registry.npmjs.org/ansi-html/-/ansi-html-0.0.7.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/ansi-html/package.json

Dependency Hierarchy:

  • build-angular-12.2.13.tgz (Root Library)
    • webpack-dev-server-3.11.2.tgz
      • ansi-html-0.0.7.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.

Publish Date: 2021-08-18

URL: CVE-2021-23424

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-23424

Release Date: 2021-08-18

Fix Resolution: VueJS.NetCore - 1.1.1;Indianadavy.VueJsWebAPITemplate.CSharp - 1.0.1;NorDroN.AngularTemplate - 0.1.6;CoreVueWebTest - 3.0.101;dotnetng.template - 1.0.0.4;Fable.Template.Elmish.React - 0.1.6;SAFE.Template - 3.0.1;GR.PageRender.Razor - 1.8.0;Envisia.DotNet.Templates - 3.0.1

CVE-2022-0512 (Medium) detected in url-parse-1.5.4.tgz - autoclosed

CVE-2022-0512 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.5.4.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.5.4.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/url-parse/package.json

Dependency Hierarchy:

  • swagger-ui-4.1.3.tgz (Root Library)
    • url-parse-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

Publish Date: 2022-02-14

URL: CVE-2022-0512

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0512

Release Date: 2022-02-14

Fix Resolution (url-parse): 1.5.6

Direct dependency fix Resolution (swagger-ui): 4.2.0


⛑️ Automatic Remediation is available for this issue

Checksum mismatch for GET API

While doing a get call for an object I am getting “MD5 signatures do not match“ warning.

[root@ssc-vm-g3-rhev4-2880 build]# s3cmd --no-ssl put /boot/vmlinuz-4.18.0-348.2.1.el8_5.x86_64 s3://testbucket3/vmlinux
upload: '/boot/vmlinuz-4.18.0-348.2.1.el8_5.x86_64' -> 's3://testbucket3/vmlinux' [1 of 1]
10210440 of 10210440 100% in 0s 51.49 MB/s done
[root@ssc-vm-g3-rhev4-2880 build]# cd
[root@ssc-vm-g3-rhev4-2880 ~]# s3cmd --no-ssl get s3://testbucket3/vmlinux vmlinux
download: 's3://testbucket3/vmlinux' -> 'vmlinux' [1 of 1]
10210440 of 10210440 100% in 0s 134.52 MB/s done
WARNING: MD5 signatures do not match: computed=92326b2cc6b6898b4c3f238dff8c0b10, received=f9c5cc6840ab0093475b3b0699f4e58b

Initial analysis:

It looks like this is affected by some bs value as per the logs.

Below logs from the Nilesh's setup where bs value is more the the object size hence it is reading in one go.

2022-01-03T23:46:03.096-0700 7f910e311700 20 req 0 0.021999992s s3:get_obj open_mobj: rc=0
944 2022-01-03T23:46:03.098-0700 7f910e311700 15 req 0 0.023999993s Encryption mode:
945 2022-01-03T23:46:03.099-0700 7f910e311700 20 req 0 0.024999993s s3:get_obj MotrObject::read_mobj(): off=0 end=10210440
946 2022-01-03T23:46:03.099-0700 7f910e311700 20 req 0 0.024999993s s3:get_obj MotrObject::read_mobj(): bs=12582912
947 2022-01-03T23:46:03.099-0700 7f910e311700 20 req 0 0.024999993s s3:get_obj MotrObject::read_mobj(): off=0 actual=1021044 0
948 2022-01-03T23:46:03.099-0700 7f910e311700 20 req 0 0.024999993s s3:get_obj MotrObject::read_mobj(): init read op rc=0
949 2022-01-03T23:46:03.179-0700 7f910e311700 20 req 0 0.104999967s s3:get_obj MotrObject::read_mobj(): call cb to process d ata

Where as, on my setup bs value is less the object size hence it is reading object in two parts from the motr.

2022-01-03T23:44:31.501-0700 7feb36d33700 20 req 0 0.001000000s s3:get_obj MotrObject::read_mobj(): off=0 end=10210440
2022-01-03T23:44:31.501-0700 7feb36d33700 20 req 0 0.001000000s s3:get_obj MotrObject::read_mobj(): bs=8388608
2022-01-03T23:44:31.501-0700 7feb36d33700 20 req 0 0.001000000s s3:get_obj MotrObject::read_mobj(): off=0 actual=8388608
2022-01-03T23:44:31.502-0700 7feb36d33700 20 req 0 0.002000001s s3:get_obj MotrObject::read_mobj(): init read op rc=0
2022-01-03T23:44:31.532-0700 7feb36d33700 20 req 0 0.032000020s s3:get_obj MotrObject::read_mobj(): call cb to process data
2022-01-03T23:44:31.536-0700 7feb36d33700 20 req 0 0.036000025s s3:get_obj MotrObject::read_mobj(): off=8388608 actual=1821832
2022-01-03T23:44:31.536-0700 7feb36d33700 20 req 0 0.036000025s s3:get_obj MotrObject::read_mobj(): init read op rc=0
2022-01-03T23:44:31.557-0700 7feb36d33700 20 req 0 0.057000041s s3:get_obj MotrObject::read_mobj(): call cb to process data
2022-01-03T23:44:31.559-0700 7feb36d33700 2 req 0 0.059000041s s3:get_obj completing

This is happening because currently we are not properly handling the case when object is read in multiple iterations from the motr depending on the optimal block size that can read at once from the motr.

CVE-2022-0639 (Medium) detected in url-parse-1.5.4.tgz - autoclosed

CVE-2022-0639 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.5.4.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.5.4.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/url-parse/package.json

Dependency Hierarchy:

  • swagger-ui-4.1.3.tgz (Root Library)
    • url-parse-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.

Publish Date: 2022-02-17

URL: CVE-2022-0639

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0639

Release Date: 2022-02-17

Fix Resolution (url-parse): 1.5.7

Direct dependency fix Resolution (swagger-ui): 4.2.0


⛑️ Automatic Remediation is available for this issue

Clean up partially written objects with GC

Currently, if an object write fails somewhere in the middle of operation (due to RGW crash, for example) - the written data is not cleaned up. We should involve RGW's built-in GC mechanism to clean up the partially written data and avoid the storage leakage.

The possible design can be like this: before writing or updating any object, we should generate the new motr-fid for it (see #5) and add it's S3-name (user+bucket+key) and the generated fid into the global gc-queue index in motr. S3-name and the fid should be the key entry in this gc-queue-index, and the value should be the date+time of when the entry was created.

RGW's GC-processes (on each RGW instance) periodically will check this global gc-queue-index in Motr and, if the object is not present in the bucket index - delete it's possibly incomplete data from Motr and its record from the queue. That's the basic idea of the algorithm.

Now, it's possible that the object is still being written and that's the reason why it's not available in the bucket index yet. To solve this problem, GC-process should check the timestamp of the record: if it was created more than, say, an hour ago, and it's still not present in the bucket index - it's definitely a stale object, and it should be removed.

When the s3-object is updated (overwritten), before writing its new metadata record into the bucket index, we should add its old fid into the gc-queue for the cleanup. Also, when we delete an object, we should write its name and fid into the gc-queue before deleting its record from the bucket index, so that the actual data is deleted by GC later - this will improve the performance of deletions also. (For deletions, we can put zero as the timestamp-value, so that the object could be deleted immediately by GC.)

Here is the sequence diagram of how an s3-object overwrite case might look like:

sequenceDiagram
Client->>rgw: Write s3-object
rgw->>rgw: generate unique motr fid
rgw->>Motr: Put generated fid to GC queue
rgw->>Motr: Write object data
Motr-->>rgw: Success
rgw->>Motr: Get old s3-object metadata (motr fid, etc.)
Motr-->>rgw: Result
alt the old object is present
rgw->>Motr: Put old object fid to GC queue
end
rgw->>Motr: Put new s3-object metadata
Motr-->>rgw: Success
rgw-->>Client: Success
Note right of rgw: After some time... GC wakes up
rgw->>Motr: Fetch next objects batch from the GC queue
Motr-->>rgw: Result
loop by each object from the result
rgw->>Motr: Check object in the bucket index
Motr-->>rgw: Result
alt Object is absent in the bucket index for more than 1hr?
rgw->>Motr: Delete stale object data
Motr-->>rgw: Success
rgw->>Motr: Delete object from GC queue
end
alt Object is present in the bucket index?
rgw->>Motr: Delete object from GC queue
end
end

CVE-2022-0686 (Medium) detected in url-parse-1.5.4.tgz - autoclosed

CVE-2022-0686 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.5.4.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.5.4.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/url-parse/package.json

Dependency Hierarchy:

  • swagger-ui-4.1.3.tgz (Root Library)
    • url-parse-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: 88df34b8503111374813cd51c3e6e503f5c24315

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

Publish Date: 2022-02-19

URL: CVE-2022-0686

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0686

Release Date: 2022-02-19

Fix Resolution: url-parse - 1.5.8

CVE-2021-44907 (High) detected in qs-6.7.0.tgz, qs-6.5.2.tgz - autoclosed

CVE-2021-44907 - High Severity Vulnerability

Vulnerable Libraries - qs-6.7.0.tgz, qs-6.5.2.tgz

qs-6.7.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.7.0.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/@applitools/eyes-cypress/node_modules/qs/package.json

Dependency Hierarchy:

  • eyes-cypress-3.22.5.tgz (Root Library)
    • express-4.17.1.tgz
      • qs-6.7.0.tgz (Vulnerable Library)
qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/@cypress/request/node_modules/qs/package.json,/src/pybind/mgr/dashboard/frontend/node_modules/request/node_modules/qs/package.json

Dependency Hierarchy:

  • cypress-9.0.0.tgz (Root Library)
    • request-2.88.10.tgz
      • qs-6.5.2.tgz (Vulnerable Library)

Found in HEAD commit: b20d1cb12a22c11ee453e8800940249afae6e8b5

Vulnerability Details

A Denial of Service vulnerability exists in qs up to 6.8.0 due to insufficient sanitization of property in the gs.parse function. The merge() function allows the assignment of properties on an array in the query. For any property being assigned, a value in the array is converted to an object containing these properties. Essentially, this means that the property whose expected type is Array always has to be checked with Array.isArray() by the user. This may not be obvious to the user and can cause unexpected behavior.

Publish Date: 2022-03-17

URL: CVE-2021-44907

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44907

Release Date: 2022-03-17

Fix Resolution: qs - 6.8.1

CVE-2012-6708 (Medium) detected in jquery-1.8.3.js

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.3.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.3/jquery.js

Path to dependency file: /qa/workunits/erasure-code/bench.html

Path to vulnerable library: /qa/workunits/erasure-code/jquery.js,/qa/workunits/erasure-code/jquery.js

Dependency Hierarchy:

  • jquery-1.8.3.js (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0

CVE-2021-3918 (High) detected in json-schema-0.2.3.tgz

CVE-2021-3918 - High Severity Vulnerability

Vulnerable Library - json-schema-0.2.3.tgz

JSON Schema validation and specifications

Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/json-schema/package.json

Dependency Hierarchy:

  • cypress-9.0.0.tgz (Root Library)
    • request-2.88.7.tgz
      • http-signature-1.2.0.tgz
        • jsprim-1.4.1.tgz
          • json-schema-0.2.3.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Vulnerability Details

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-11-13

URL: CVE-2021-3918

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918

Release Date: 2021-11-13

Fix Resolution: json-schema - 0.4.0

CVE-2022-24773 (Medium) detected in node-forge-0.10.0.tgz

CVE-2022-24773 - Medium Severity Vulnerability

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /src/pybind/mgr/dashboard/frontend/package.json

Path to vulnerable library: /src/pybind/mgr/dashboard/frontend/node_modules/node-forge/package.json

Dependency Hierarchy:

  • build-angular-12.2.13.tgz (Root Library)
    • webpack-dev-server-3.11.2.tgz
      • selfsigned-1.10.11.tgz
        • node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: aa78617d024ccd26801e43c6980f939cf8bded5f

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24773

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (@angular-devkit/build-angular): 13.3.3


⛑️ Automatic Remediation is available for this issue

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.