(DEPRECATED) Apache Flink User Mailing List archive.

Dependency vulnerabilities with flink 1.11.1 version

classic Classic list List threaded Threaded
♦
♦
 5 messages Options
V N, Suchithra (Nokia - IN/Bangalore)
Reply | Threaded
Open this post in threaded view
♦
♦
|

Dependency vulnerabilities with flink 1.11.1 version

V N, Suchithra (Nokia - IN/Bangalore)

 

Hello,

 

We are using Apache Flink 1.11.1 version. During our security scans following issues are reported by our scan tool.

 

1.Package : commons_codec-1.10

Severity: Medium

 

Description:

Apache Commons contains a flaw that is due to the Base32 codec decoding invalid strings instead of rejecting them. This may allow a remote attacker to tunnel additional information via a base 32 string that seems valid.

 

Path:

/opt/flink/lib/flink-table_2.11-1.11.1.jar:commons-codec

/opt/flink/lib/flink-table-blink_2.11-1.11.1.jar:commons-codec

 

References:

https://issues.apache.org/jira/browse/CODEC-134

https://issues.apache.org/jira/browse/HTTPCLIENT-2018

 

2. Package : antlr-4.7

Severity: Medium

 

Description:

ANTLR contains a flaw in runtime/Java/src/org/antlr/v4/runtime/atn/ParserATNSimulator.java that is triggered as it does not catch exceptions when attempting to access the TURN_OFF_LR_LOOP_ENTRY_BRANCH_OPT environment variable. This may allow a context-dependent attacker to potentially crash a process linked against the library.

 

Path:

/opt/flink/opt/flink-python_2.11-1.11.1.jar:antlr4-runtime

References:

https://github.com/antlr/antlr4/issues/2069

 

3. Package : mesos-1.0.1

Severity: Medium

 

Description:

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.

Path:

/opt/flink/lib/flink-dist_2.11-1.11.1.jar:mesos

 

References:

https://nvd.nist.gov/vuln/detail/CVE-2018-8023

 

4. Package : okhttp-3.7.0

Severity: Medium

 

Description:

** DISPUTED ** CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don't consider this is a vulnerability. Their rationale can be found in https://github.com/square/okhttp/issues/4967.

Path:

/opt/flink/plugins/metrics-datadog/flink-metrics-datadog-1.11.1.jar:okhttp

References:

https://nvd.nist.gov/vuln/detail/CVE-2018-20200

 

5. Package : commons_io-2.4

Severity: Medium

 

Description:

Apache Commons IO contains a flaw that allows traversing outside of a restricted path. The issue is due to FileNameUtils.normalize not properly sanitizing user input, specifically path traversal style attacks (e.g. '../'). With a specially crafted request, a remote attacker can disclose arbitrary files.

Path:

/opt/flink/lib/flink-dist_2.11-1.11.1.jar:commons-io

/opt/flink/lib/flink-table-blink_2.11-1.11.1.jar:commons-io

 

References:

https://issues.apache.org/jira/browse/IO-556

 

Please let us know your comments on these issues and fix plans.

 

Regards,

Suchithra
Till Rohrmann
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Dependency vulnerabilities with flink 1.11.1 version

Till Rohrmann
Hi Suchithra,

thanks for doing this analysis. I think we should try to upgrade the affected libraries. I have opened issues to do these changes [1, 2, 3, 4, 5]. In the future, it would be great if you could first reach out to [hidden email] so that we can fix these problems without drawing attention to them.


Cheers,
Till

On Thu, Oct 22, 2020 at 12:56 PM V N, Suchithra (Nokia - IN/Bangalore) <[hidden email]> wrote:

 

Hello,

 

We are using Apache Flink 1.11.1 version. During our security scans following issues are reported by our scan tool.

 

1.Package : commons_codec-1.10

Severity: Medium

 

Description:

Apache Commons contains a flaw that is due to the Base32 codec decoding invalid strings instead of rejecting them. This may allow a remote attacker to tunnel additional information via a base 32 string that seems valid.

 

Path:

/opt/flink/lib/flink-table_2.11-1.11.1.jar:commons-codec

/opt/flink/lib/flink-table-blink_2.11-1.11.1.jar:commons-codec

 

References:

https://issues.apache.org/jira/browse/CODEC-134

https://issues.apache.org/jira/browse/HTTPCLIENT-2018

 

2. Package : antlr-4.7

Severity: Medium

 

Description:

ANTLR contains a flaw in runtime/Java/src/org/antlr/v4/runtime/atn/ParserATNSimulator.java that is triggered as it does not catch exceptions when attempting to access the TURN_OFF_LR_LOOP_ENTRY_BRANCH_OPT environment variable. This may allow a context-dependent attacker to potentially crash a process linked against the library.

 

Path:

/opt/flink/opt/flink-python_2.11-1.11.1.jar:antlr4-runtime

References:

https://github.com/antlr/antlr4/issues/2069

 

3. Package : mesos-1.0.1

Severity: Medium

 

Description:

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.

Path:

/opt/flink/lib/flink-dist_2.11-1.11.1.jar:mesos

 

References:

https://nvd.nist.gov/vuln/detail/CVE-2018-8023

 

4. Package : okhttp-3.7.0

Severity: Medium

 

Description:

** DISPUTED ** CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don't consider this is a vulnerability. Their rationale can be found in https://github.com/square/okhttp/issues/4967.

Path:

/opt/flink/plugins/metrics-datadog/flink-metrics-datadog-1.11.1.jar:okhttp

References:

https://nvd.nist.gov/vuln/detail/CVE-2018-20200

 

5. Package : commons_io-2.4

Severity: Medium

 

Description:

Apache Commons IO contains a flaw that allows traversing outside of a restricted path. The issue is due to FileNameUtils.normalize not properly sanitizing user input, specifically path traversal style attacks (e.g. '../'). With a specially crafted request, a remote attacker can disclose arbitrary files.

Path:

/opt/flink/lib/flink-dist_2.11-1.11.1.jar:commons-io

/opt/flink/lib/flink-table-blink_2.11-1.11.1.jar:commons-io

 

References:

https://issues.apache.org/jira/browse/IO-556

 

Please let us know your comments on these issues and fix plans.

 

Regards,

Suchithra
rmetzger0
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Dependency vulnerabilities with flink 1.11.1 version

rmetzger0
Hey Suchithra,
thanks a lot for this report. I'm in the process of closing all the tickets Till has created (by pushing version upgrades to Flink).

The fixes will be released with the upcoming Flink 1.12 release.
I have decided against backporting the fixes to the 1.11 line of Flink, because they usually require large dependency version jumps, and none of the vulnerabilities reported have a confirmed case of directly affecting Flink. For example the issue in commons-io affects the FileNameUtils.normalize, which we are not using in Flink.

Best,
Robert



On Fri, Oct 23, 2020 at 10:55 AM Till Rohrmann <[hidden email]> wrote:
Hi Suchithra,

thanks for doing this analysis. I think we should try to upgrade the affected libraries. I have opened issues to do these changes [1, 2, 3, 4, 5]. In the future, it would be great if you could first reach out to [hidden email] so that we can fix these problems without drawing attention to them.


Cheers,
Till

On Thu, Oct 22, 2020 at 12:56 PM V N, Suchithra (Nokia - IN/Bangalore) <[hidden email]> wrote:

 

Hello,

 

We are using Apache Flink 1.11.1 version. During our security scans following issues are reported by our scan tool.

 

1.Package : commons_codec-1.10

Severity: Medium

 

Description:

Apache Commons contains a flaw that is due to the Base32 codec decoding invalid strings instead of rejecting them. This may allow a remote attacker to tunnel additional information via a base 32 string that seems valid.

 

Path:

/opt/flink/lib/flink-table_2.11-1.11.1.jar:commons-codec

/opt/flink/lib/flink-table-blink_2.11-1.11.1.jar:commons-codec

 

References:

https://issues.apache.org/jira/browse/CODEC-134

https://issues.apache.org/jira/browse/HTTPCLIENT-2018

 

2. Package : antlr-4.7

Severity: Medium

 

Description:

ANTLR contains a flaw in runtime/Java/src/org/antlr/v4/runtime/atn/ParserATNSimulator.java that is triggered as it does not catch exceptions when attempting to access the TURN_OFF_LR_LOOP_ENTRY_BRANCH_OPT environment variable. This may allow a context-dependent attacker to potentially crash a process linked against the library.

 

Path:

/opt/flink/opt/flink-python_2.11-1.11.1.jar:antlr4-runtime

References:

https://github.com/antlr/antlr4/issues/2069

 

3. Package : mesos-1.0.1

Severity: Medium

 

Description:

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.

Path:

/opt/flink/lib/flink-dist_2.11-1.11.1.jar:mesos

 

References:

https://nvd.nist.gov/vuln/detail/CVE-2018-8023

 

4. Package : okhttp-3.7.0

Severity: Medium

 

Description:

** DISPUTED ** CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don't consider this is a vulnerability. Their rationale can be found in https://github.com/square/okhttp/issues/4967.

Path:

/opt/flink/plugins/metrics-datadog/flink-metrics-datadog-1.11.1.jar:okhttp

References:

https://nvd.nist.gov/vuln/detail/CVE-2018-20200

 

5. Package : commons_io-2.4

Severity: Medium

 

Description:

Apache Commons IO contains a flaw that allows traversing outside of a restricted path. The issue is due to FileNameUtils.normalize not properly sanitizing user input, specifically path traversal style attacks (e.g. '../'). With a specially crafted request, a remote attacker can disclose arbitrary files.

Path:

/opt/flink/lib/flink-dist_2.11-1.11.1.jar:commons-io

/opt/flink/lib/flink-table-blink_2.11-1.11.1.jar:commons-io

 

References:

https://issues.apache.org/jira/browse/IO-556

 

Please let us know your comments on these issues and fix plans.

 

Regards,

Suchithra
rmetzger0
Reply | Threaded
Open this post in threaded view
♦
♦
|

Re: Dependency vulnerabilities with flink 1.11.1 version

rmetzger0
FYI: For the sake of completeness, I have added some reasoning to all the JIRA tickets why we are not backporting fixes to the 1.11-line of Flink.

On Mon, Oct 26, 2020 at 4:51 PM Robert Metzger <[hidden email]> wrote:
Hey Suchithra,
thanks a lot for this report. I'm in the process of closing all the tickets Till has created (by pushing version upgrades to Flink).

The fixes will be released with the upcoming Flink 1.12 release.
I have decided against backporting the fixes to the 1.11 line of Flink, because they usually require large dependency version jumps, and none of the vulnerabilities reported have a confirmed case of directly affecting Flink. For example the issue in commons-io affects the FileNameUtils.normalize, which we are not using in Flink.

Best,
Robert



On Fri, Oct 23, 2020 at 10:55 AM Till Rohrmann <[hidden email]> wrote:
Hi Suchithra,

thanks for doing this analysis. I think we should try to upgrade the affected libraries. I have opened issues to do these changes [1, 2, 3, 4, 5]. In the future, it would be great if you could first reach out to [hidden email] so that we can fix these problems without drawing attention to them.


Cheers,
Till

On Thu, Oct 22, 2020 at 12:56 PM V N, Suchithra (Nokia - IN/Bangalore) <[hidden email]> wrote:

 

Hello,

 

We are using Apache Flink 1.11.1 version. During our security scans following issues are reported by our scan tool.

 

1.Package : commons_codec-1.10

Severity: Medium

 

Description:

Apache Commons contains a flaw that is due to the Base32 codec decoding invalid strings instead of rejecting them. This may allow a remote attacker to tunnel additional information via a base 32 string that seems valid.

 

Path:

/opt/flink/lib/flink-table_2.11-1.11.1.jar:commons-codec

/opt/flink/lib/flink-table-blink_2.11-1.11.1.jar:commons-codec

 

References:

https://issues.apache.org/jira/browse/CODEC-134

https://issues.apache.org/jira/browse/HTTPCLIENT-2018

 

2. Package : antlr-4.7

Severity: Medium

 

Description:

ANTLR contains a flaw in runtime/Java/src/org/antlr/v4/runtime/atn/ParserATNSimulator.java that is triggered as it does not catch exceptions when attempting to access the TURN_OFF_LR_LOOP_ENTRY_BRANCH_OPT environment variable. This may allow a context-dependent attacker to potentially crash a process linked against the library.

 

Path:

/opt/flink/opt/flink-python_2.11-1.11.1.jar:antlr4-runtime

References:

https://github.com/antlr/antlr4/issues/2069

 

3. Package : mesos-1.0.1

Severity: Medium

 

Description:

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.

Path:

/opt/flink/lib/flink-dist_2.11-1.11.1.jar:mesos

 

References:

https://nvd.nist.gov/vuln/detail/CVE-2018-8023

 

4. Package : okhttp-3.7.0

Severity: Medium

 

Description:

** DISPUTED ** CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don't consider this is a vulnerability. Their rationale can be found in https://github.com/square/okhttp/issues/4967.

Path:

/opt/flink/plugins/metrics-datadog/flink-metrics-datadog-1.11.1.jar:okhttp

References:

https://nvd.nist.gov/vuln/detail/CVE-2018-20200

 

5. Package : commons_io-2.4

Severity: Medium

 

Description:

Apache Commons IO contains a flaw that allows traversing outside of a restricted path. The issue is due to FileNameUtils.normalize not properly sanitizing user input, specifically path traversal style attacks (e.g. '../'). With a specially crafted request, a remote attacker can disclose arbitrary files.

Path:

/opt/flink/lib/flink-dist_2.11-1.11.1.jar:commons-io

/opt/flink/lib/flink-table-blink_2.11-1.11.1.jar:commons-io

 

References:

https://issues.apache.org/jira/browse/IO-556

 

Please let us know your comments on these issues and fix plans.

 

Regards,

Suchithra
V N, Suchithra (Nokia - IN/Bangalore)
Reply | Threaded
Open this post in threaded view
♦
♦
|

RE: Dependency vulnerabilities with flink 1.11.1 version

V N, Suchithra (Nokia - IN/Bangalore)

Thanks Robert.

 

Regards,

Suchithra

 

From: Robert Metzger <[hidden email]>
Sent: Tuesday, October 27, 2020 9:10 PM
To: Till Rohrmann <[hidden email]>
Cc: V N, Suchithra (Nokia - IN/Bangalore) <[hidden email]>; [hidden email]
Subject: Re: Dependency vulnerabilities with flink 1.11.1 version

 

FYI: For the sake of completeness, I have added some reasoning to all the JIRA tickets why we are not backporting fixes to the 1.11-line of Flink.

 

On Mon, Oct 26, 2020 at 4:51 PM Robert Metzger <[hidden email]> wrote:

Hey Suchithra,

thanks a lot for this report. I'm in the process of closing all the tickets Till has created (by pushing version upgrades to Flink).

 

The fixes will be released with the upcoming Flink 1.12 release.

I have decided against backporting the fixes to the 1.11 line of Flink, because they usually require large dependency version jumps, and none of the vulnerabilities reported have a confirmed case of directly affecting Flink. For example the issue in commons-io affects the FileNameUtils.normalize, which we are not using in Flink.

 

Best,
Robert

 

 

 

On Fri, Oct 23, 2020 at 10:55 AM Till Rohrmann <[hidden email]> wrote:

Hi Suchithra,

 

thanks for doing this analysis. I think we should try to upgrade the affected libraries. I have opened issues to do these changes [1, 2, 3, 4, 5]. In the future, it would be great if you could first reach out to [hidden email] so that we can fix these problems without drawing attention to them.

 

 

Cheers,

Till

 

On Thu, Oct 22, 2020 at 12:56 PM V N, Suchithra (Nokia - IN/Bangalore) <[hidden email]> wrote:

 

Hello,

 

We are using Apache Flink 1.11.1 version. During our security scans following issues are reported by our scan tool.

 

1.Package : commons_codec-1.10

Severity: Medium

 

Description:

Apache Commons contains a flaw that is due to the Base32 codec decoding invalid strings instead of rejecting them. This may allow a remote attacker to tunnel additional information via a base 32 string that seems valid.

 

Path:

/opt/flink/lib/flink-table_2.11-1.11.1.jar:commons-codec

/opt/flink/lib/flink-table-blink_2.11-1.11.1.jar:commons-codec

 

References:

https://issues.apache.org/jira/browse/CODEC-134

https://issues.apache.org/jira/browse/HTTPCLIENT-2018

 

2. Package : antlr-4.7

Severity: Medium

 

Description:

ANTLR contains a flaw in runtime/Java/src/org/antlr/v4/runtime/atn/ParserATNSimulator.java that is triggered as it does not catch exceptions when attempting to access the TURN_OFF_LR_LOOP_ENTRY_BRANCH_OPT environment variable. This may allow a context-dependent attacker to potentially crash a process linked against the library.

 

Path:

/opt/flink/opt/flink-python_2.11-1.11.1.jar:antlr4-runtime

References:

https://github.com/antlr/antlr4/issues/2069

 

3. Package : mesos-1.0.1

Severity: Medium

 

Description:

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.

Path:

/opt/flink/lib/flink-dist_2.11-1.11.1.jar:mesos

 

References:

https://nvd.nist.gov/vuln/detail/CVE-2018-8023

 

4. Package : okhttp-3.7.0

Severity: Medium

 

Description:

** DISPUTED ** CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don't consider this is a vulnerability. Their rationale can be found in https://github.com/square/okhttp/issues/4967.

Path:

/opt/flink/plugins/metrics-datadog/flink-metrics-datadog-1.11.1.jar:okhttp

References:

https://nvd.nist.gov/vuln/detail/CVE-2018-20200

 

5. Package : commons_io-2.4

Severity: Medium

 

Description:

Apache Commons IO contains a flaw that allows traversing outside of a restricted path. The issue is due to FileNameUtils.normalize not properly sanitizing user input, specifically path traversal style attacks (e.g. '../'). With a specially crafted request, a remote attacker can disclose arbitrary files.

Path:

/opt/flink/lib/flink-dist_2.11-1.11.1.jar:commons-io

/opt/flink/lib/flink-table-blink_2.11-1.11.1.jar:commons-io

 

References:

https://issues.apache.org/jira/browse/IO-556

 

Please let us know your comments on these issues and fix plans.

 

Regards,

Suchithra
Free forum by Nabble Edit this page