Skip to content
This repository was archived by the owner on Oct 2, 2023. It is now read-only.

Dependency upgrades 4.0 #240

Draft
wants to merge 6 commits into
base: master
Choose a base branch
from
+648 −539
Draft

Dependency upgrades 4.0 #240

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
381b02f
updates to dependencies
erictice Jul 12, 2021
b4257a9
updated spring-boot-starter-parent
erictice Jul 12, 2021
47aba46
Changes to update dependencies, relies on version core-4.0.0 of
erictice Jul 13, 2021
f6b619a
Updates to log4j dependency
erictice Jul 23, 2021
3fed6db
updates to dependencies
erictice Jul 30, 2021
2495f10
Update to pom.xml, test dependency updates
erictice Aug 6, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Updates to log4j dependency
  • Loading branch information
@erictice
erictice committed Jul 23, 2021

Unverified

This user has not yet uploaded their public signing key.
GPG key ID: 55740854AAA9C436
Learn about vigilant mode
commit f6b619abac7cd010fdd7f1f0e911d1a330704cd9
14 changes: 10 additions & 4 deletions pom.xml
View file
Original file line number Diff line number Diff line change
@@ -83,6 +83,7 @@
<jackson.version>2.11.4</jackson.version>
<jasypt.version>1.18</jasypt.version>
<logback.version>1.2.3</logback.version>
<log4j2.version>2.14.1</log4j2.version>
<mongodb.version>4.0.0</mongodb.version>
<jjwt.version>0.6.0</jjwt.version>
<springfox.version>2.4.0</springfox.version>
@@ -157,10 +158,15 @@

<!-- https://mvnrepository.com/artifact/log4j/log4j -->
<dependency>
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:  

pkg:maven/log4j/[email protected]

1 Critical, 0 Severe, 1 Moderate and 0 Unknown vulnerabilities have been found in a direct dependency

CRITICAL Vulnerabilities (1)
    CVE-2019-17571

    [CVE-2019-17571] Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserializat...

    Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

    CVSS Score: 9.8

    CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MODERATE Vulnerabilities (1)
    CVE-2020-9488

    [CVE-2020-9488] Improper validation of certificate with host mismatch in Apache Log4j SMTP appen...

    Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

    CVSS Score: 3.7

    CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

(at-me in a reply with help or ignore)

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updates have been checked in

<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<version>1.2.17</version>
</dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-api</artifactId>
<version>${log4j2.version}</version>
</dependency>
<dependency>
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:  

pkg:maven/org.apache.commons/[email protected]

4 Critical, 0 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:maven/org.apache.logging.log4j/[email protected]

CRITICAL Vulnerabilities (4)
    CVE-2021-36090

    [CVE-2021-36090] When reading a specially crafted ZIP archive, Compress can be made to allocate l...

    When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.

    CVSS Score: 7.5

    CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    CVE-2021-35517

    [CVE-2021-35517] When reading a specially crafted TAR archive, Compress can be made to allocate l...

    When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.

    CVSS Score: 7.5

    CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    CVE-2021-35515

    [CVE-2021-35515] When reading a specially crafted 7Z archive, the construction of the list of cod...

    When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

    CVSS Score: 7.5

    CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    CVE-2021-35516

    [CVE-2021-35516] When reading a specially crafted 7Z archive, Compress can be made to allocate la...

    When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

    CVSS Score: 7.5

    CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

(at-me in a reply with help or ignore)

<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>${log4j2.version}</version>
</dependency>


<dependency>
5 changes: 3 additions & 2 deletions src/main/java/com/capitalone/dashboard/auth/ldap/CustomUserDetailsContextMapper.java
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package com.capitalone.dashboard.auth.ldap;

import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.springframework.context.annotation.Configuration;
import org.springframework.ldap.core.DirContextAdapter;
import org.springframework.ldap.core.DirContextOperations;
@@ -14,7 +15,7 @@
@Configuration
public class CustomUserDetailsContextMapper extends LdapUserDetailsMapper {

private static final Logger LOGGER = Logger.getLogger(CustomUserDetailsContextMapper.class);
private static final Logger LOGGER = LogManager.getLogger(CustomUserDetailsContextMapper.class);

@Override
public CustomUserDetails mapUserFromContext(DirContextOperations ctx, String username, Collection authorities) {
5 changes: 3 additions & 2 deletions src/main/java/com/capitalone/dashboard/auth/sso/SsoAuthenticationFilter.java
View file
Original file line number Diff line number Diff line change
@@ -7,7 +7,8 @@
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.core.Authentication;
@@ -19,7 +20,7 @@

@Component
public class SsoAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
private static final Logger LOGGER = Logger.getLogger(SsoAuthenticationFilter.class);
private static final Logger LOGGER = LogManager.getLogger(SsoAuthenticationFilter.class);

@Autowired
private SsoAuthenticationService ssoAuthenticationService;
5 changes: 3 additions & 2 deletions src/main/java/com/capitalone/dashboard/auth/sso/SsoAuthenticationServiceImpl.java
View file
Original file line number Diff line number Diff line change
@@ -5,7 +5,8 @@
import java.util.HashMap;
import java.util.Map;

import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
@@ -17,7 +18,7 @@

@Component
public class SsoAuthenticationServiceImpl implements SsoAuthenticationService {
private static final Logger LOGGER = Logger.getLogger(SsoAuthenticationServiceImpl.class);
private static final Logger LOGGER = LogManager.getLogger(SsoAuthenticationServiceImpl.class);

@Autowired
private SsoAuthenticationUtil ssoAuthenticationUtil;
5 changes: 3 additions & 2 deletions src/main/java/com/capitalone/dashboard/auth/sso/SsoAuthenticationUtil.java
View file
Original file line number Diff line number Diff line change
@@ -3,7 +3,8 @@
import java.util.ArrayList;
import java.util.Map;

import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
@@ -16,7 +17,7 @@

@Component
public class SsoAuthenticationUtil {
private static final Logger LOGGER = Logger.getLogger(SsoAuthenticationUtil.class);
private static final Logger LOGGER = LogManager.getLogger(SsoAuthenticationUtil.class);

@Autowired
private AuthProperties authProperties;
5 changes: 3 additions & 2 deletions src/main/java/com/capitalone/dashboard/auth/token/JwtAuthenticationFilter.java
View file
Original file line number Diff line number Diff line change
@@ -11,7 +11,8 @@

import org.apache.commons.collections4.MapUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.annotation.Order;
import org.springframework.security.core.Authentication;
@@ -24,7 +25,7 @@
@Order(2)
public class JwtAuthenticationFilter extends OncePerRequestFilter {

private static final Logger LOGGER = Logger.getLogger(JwtAuthenticationFilter.class);
private static final Logger LOGGER = LogManager.getLogger(JwtAuthenticationFilter.class);
private TokenAuthenticationService tokenAuthenticationService;

@Autowired
5 changes: 3 additions & 2 deletions src/main/java/com/capitalone/dashboard/logging/LoggingFilter.java
View file
Original file line number Diff line number Diff line change
@@ -40,7 +40,8 @@
import org.apache.commons.io.output.TeeOutputStream;
import org.apache.commons.lang3.StringUtils;
import org.apache.commons.lang3.exception.ExceptionUtils;
import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.annotation.Order;
import org.springframework.http.HttpMethod;
@@ -57,7 +58,7 @@
@Order(1)
public class LoggingFilter implements Filter {

private static final Logger LOGGER = Logger.getLogger("LoggingFilter");
private static final Logger LOGGER = LogManager.getLogger("LoggingFilter");

private static final String API_USER_KEY = "apiUser";

5 changes: 3 additions & 2 deletions src/main/java/com/capitalone/dashboard/rest/PingController.java
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
package com.capitalone.dashboard.rest;

import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.PropertySource;
import org.springframework.http.HttpStatus;
@@ -15,7 +16,7 @@

@RestController
public class PingController {
private static final Logger LOGGER = Logger.getLogger(PingController.class);
private static final Logger LOGGER = LogManager.getLogger(PingController.class);

@Value("${version.number}")
private String versionNumber;
5 changes: 3 additions & 2 deletions src/main/java/com/capitalone/dashboard/service/ApiTokenServiceImpl.java
View file
Original file line number Diff line number Diff line change
@@ -10,7 +10,8 @@
import java.util.Optional;

import org.apache.commons.collections4.CollectionUtils;
import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.bson.types.ObjectId;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.BadCredentialsException;
@@ -33,7 +34,7 @@
@Component
public class ApiTokenServiceImpl implements ApiTokenService {

private static final Logger LOGGER = Logger.getLogger(ApiTokenServiceImpl.class);
private static final Logger LOGGER = LogManager.getLogger(ApiTokenServiceImpl.class);

private ApiTokenRepository apiTokenRepository;

5 changes: 3 additions & 2 deletions src/main/java/com/capitalone/dashboard/service/BuildServiceImpl.java
View file
Original file line number Diff line number Diff line change
@@ -27,7 +27,8 @@
import com.querydsl.core.BooleanBuilder;
import org.apache.commons.collections4.CollectionUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.bson.types.ObjectId;
import org.joda.time.LocalDate;
import org.springframework.beans.factory.annotation.Autowired;
@@ -60,7 +61,7 @@ public class BuildServiceImpl implements BuildService {
@Autowired
private ApiSettings settings;

private static final Logger LOGGER = Logger.getLogger(BuildService.class);
private static final Logger LOGGER = LogManager.getLogger(BuildService.class);

@Autowired
public BuildServiceImpl(BuildRepository buildRepository,
5 changes: 3 additions & 2 deletions src/main/java/com/capitalone/dashboard/service/DynamicPipelineServiceImpl.java
View file
Original file line number Diff line number Diff line change
@@ -16,7 +16,8 @@

import com.capitalone.dashboard.misc.HygieiaException;
import org.apache.commons.lang3.ObjectUtils;
import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.bson.types.ObjectId;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
@@ -65,7 +66,7 @@
*/
@Service("dynamic-pipeline")
public class DynamicPipelineServiceImpl implements PipelineService {
private static final Logger logger = Logger.getLogger(DynamicPipelineServiceImpl.class);
private static final Logger logger = LogManager.getLogger(DynamicPipelineServiceImpl.class);

private static final int PROD_COMMIT_DATE_RANGE_DEFAULT = -90;

1 change: 0 additions & 1 deletion src/main/java/com/capitalone/dashboard/service/FeatureFlagServiceImpl.java
View file
Original file line number Diff line number Diff line change
@@ -6,7 +6,6 @@
import com.google.gson.Gson;
import com.google.gson.GsonBuilder;
import org.apache.commons.collections4.IterableUtils;
import org.apache.log4j.Logger;
import org.bson.types.ObjectId;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
5 changes: 3 additions & 2 deletions src/main/java/com/capitalone/dashboard/service/ScoreDashboardServiceImpl.java
View file
Original file line number Diff line number Diff line change
@@ -8,7 +8,8 @@
import com.capitalone.dashboard.repository.CollectorItemRepository;
import com.capitalone.dashboard.repository.ScoreCollectorItemRepository;
import org.apache.commons.collections.CollectionUtils;
import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.bson.types.ObjectId;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
@@ -18,7 +19,7 @@
@Service
public class ScoreDashboardServiceImpl implements ScoreDashboardService {

private static final Logger LOGGER = Logger.getLogger(ScoreDashboardServiceImpl.class);
private static final Logger LOGGER = LogManager.getLogger(ScoreDashboardServiceImpl.class);

private final CollectorService collectorService;
private final ScoreCollectorItemRepository scoreCollectorItemRepository;
5 changes: 3 additions & 2 deletions src/main/java/com/capitalone/dashboard/service/ServiceAccountServiceImpl.java
View file
Original file line number Diff line number Diff line change
@@ -3,7 +3,8 @@
import com.capitalone.dashboard.model.ServiceAccount;
import com.capitalone.dashboard.repository.ServiceAccountRepository;
import com.google.common.collect.Sets;
import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.bson.types.ObjectId;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
@@ -13,7 +14,7 @@
@Component
public class ServiceAccountServiceImpl implements ServiceAccountService {

private static final Logger LOGGER = Logger.getLogger(ServiceAccountServiceImpl.class);
private static final Logger LOGGER = LogManager.getLogger(ServiceAccountServiceImpl.class);


private ServiceAccountRepository serviceAccountRepository;
5 changes: 3 additions & 2 deletions src/main/java/com/capitalone/dashboard/service/TestResultServiceImpl.java
View file
Original file line number Diff line number Diff line change
@@ -20,7 +20,8 @@
import hygieia.transformer.JunitXmlToTestCapabilityTransformer;
import hygieia.transformer.JunitXmlToTestCapabilityTransformerV2;
import org.apache.commons.lang3.StringUtils;
import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.bson.types.ObjectId;
import org.joda.time.format.DateTimeFormat;
import org.springframework.beans.factory.annotation.Autowired;
@@ -52,7 +53,7 @@ public class TestResultServiceImpl implements TestResultService {
private final CmdbService cmdbService;
private final ApiSettings apiSettings;

private static final Logger LOGGER = Logger.getLogger(ApiTokenServiceImpl.class);
private static final Logger LOGGER = LogManager.getLogger(ApiTokenServiceImpl.class);

@Autowired
public TestResultServiceImpl(TestResultRepository testResultRepository,
5 changes: 3 additions & 2 deletions src/main/java/com/capitalone/dashboard/service/UserInfoServiceImpl.java
View file
Original file line number Diff line number Diff line change
@@ -6,7 +6,8 @@

import com.capitalone.dashboard.auth.AuthProperties;
import org.apache.commons.lang3.StringUtils;
import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
@@ -32,7 +33,7 @@
@Component
public class UserInfoServiceImpl implements UserInfoService {

private static final Logger LOGGER = Logger.getLogger(UserInfoServiceImpl.class);
private static final Logger LOGGER = LogManager.getLogger(UserInfoServiceImpl.class);

private UserInfoRepository userInfoRepository;
@Autowired
3 changes: 2 additions & 1 deletion src/test/java/com/capitalone/dashboard/logging/LoggingFilterTest.java
View file
Original file line number Diff line number Diff line change
@@ -11,7 +11,8 @@
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.log4j.Logger;
import org.apache.logging.log4j.Logger;
import org.apache.logging.log4j.LogManager;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.mockito.InjectMocks;