From 28da5021fad45b2c4da1bd1b7db794863e5ef7f3 Mon Sep 17 00:00:00 2001
From: Patrick Brady <pb071s@att.com>
Date: Mon, 17 Sep 2018 12:52:55 -0700
Subject: Remove logback 1.1.3 security issue

cdp-pal and eelf are the dependencies using logback-classic
1.1.3. Need to use exclusions option in pom file

Change-Id: Id8f5817ec955e2b7b486bc0215c35541086606aa
Signed-off-by: Patrick Brady <pb071s@att.com>
Issue-ID: APPC-1018
---
 appc-config/appc-config-adaptor/provider/pom.xml   | 12 +++++++++++-
 appc-config/appc-config-audit/provider/pom.xml     | 11 +++++++++++
 appc-config/appc-config-generator/provider/pom.xml | 12 +++++++++++-
 appc-config/appc-data-services/provider/pom.xml    | 14 +++++++++++++-
 appc-config/appc-encryption-tool/provider/pom.xml  | 11 +++++++++++
 appc-config/appc-flow-controller/provider/pom.xml  | 14 +++++++++++++-
 6 files changed, 70 insertions(+), 4 deletions(-)

(limited to 'appc-config')

diff --git a/appc-config/appc-config-adaptor/provider/pom.xml b/appc-config/appc-config-adaptor/provider/pom.xml
index aa5e24f51..4fbf5a5e7 100644
--- a/appc-config/appc-config-adaptor/provider/pom.xml
+++ b/appc-config/appc-config-adaptor/provider/pom.xml
@@ -70,10 +70,20 @@
 			<artifactId>mockito-core</artifactId>
 			<scope>test</scope>
 		</dependency>
-
+        <dependency>
+         <groupId>ch.qos.logback</groupId>
+         <artifactId>logback-classic</artifactId>
+	 <version>${logback.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.att.eelf</groupId>
             <artifactId>eelf-core</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>ch.qos.logback</groupId>
+                    <artifactId>logback-classic</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
diff --git a/appc-config/appc-config-audit/provider/pom.xml b/appc-config/appc-config-audit/provider/pom.xml
index 3babf6d6f..bb6629200 100644
--- a/appc-config/appc-config-audit/provider/pom.xml
+++ b/appc-config/appc-config-audit/provider/pom.xml
@@ -73,9 +73,20 @@
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
         </dependency>
+        <dependency>
+         <groupId>ch.qos.logback</groupId>
+         <artifactId>logback-classic</artifactId>
+	 <version>${logback.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.att.eelf</groupId>
             <artifactId>eelf-core</artifactId>
+            <exclusions>
+                <exclusion>
+                     <groupId>ch.qos.logback</groupId>
+                     <artifactId>logback-classic</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.apache.commons</groupId>
diff --git a/appc-config/appc-config-generator/provider/pom.xml b/appc-config/appc-config-generator/provider/pom.xml
index 271873581..fd5eacdc1 100644
--- a/appc-config/appc-config-generator/provider/pom.xml
+++ b/appc-config/appc-config-generator/provider/pom.xml
@@ -94,10 +94,20 @@
                 <artifactId>commons-collections</artifactId>
                 <version>3.2.2</version>
           </dependency>
-
+         <dependency>
+           <groupId>ch.qos.logback</groupId>
+           <artifactId>logback-classic</artifactId>
+	   <version>${logback.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.att.eelf</groupId>
             <artifactId>eelf-core</artifactId>
+            <exclusions>
+                 <exclusion>
+                      <groupId>ch.qos.logback</groupId>
+                      <artifactId>logback-classic</artifactId>
+                 </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
diff --git a/appc-config/appc-data-services/provider/pom.xml b/appc-config/appc-data-services/provider/pom.xml
index 92468db81..0b5676ea0 100644
--- a/appc-config/appc-data-services/provider/pom.xml
+++ b/appc-config/appc-data-services/provider/pom.xml
@@ -62,10 +62,21 @@
 			<groupId>commons-io</groupId>
 			<artifactId>commons-io</artifactId>
 		</dependency>
+                <dependency>
+                     <groupId>ch.qos.logback</groupId>
+                     <artifactId>logback-classic</artifactId>
+	             <version>${logback.version}</version>
+                </dependency>
 
 		<dependency>
 			<groupId>com.att.eelf</groupId>
 			<artifactId>eelf-core</artifactId>
+                       <exclusions>
+                            <exclusion>
+                                 <groupId>ch.qos.logback</groupId>
+                                 <artifactId>logback-classic</artifactId>
+                            </exclusion>
+                        </exclusions>
 		</dependency>
 
 		<dependency>
@@ -138,7 +149,8 @@
 						<Bundle-SymbolicName>appc-config-data-services</Bundle-SymbolicName>
 						<Bundle-Activator>org.onap.appc.data.services.AppcDataServiceActivator</Bundle-Activator>
 						<Export-Package>org.onap.appc.data.services</Export-Package>
-						<Import-Package>*</Import-Package>
+						<Import-Package>groovy.lang;resolution:=optional,
+						    org.codehaus.groovy.*;resolution:=optional,*</Import-Package>
 						<Embed-Dependency>eelf-core,logback-core,logback-classic</Embed-Dependency>
 						<DynamicImport-Package>*</DynamicImport-Package>
 					</instructions>
diff --git a/appc-config/appc-encryption-tool/provider/pom.xml b/appc-config/appc-encryption-tool/provider/pom.xml
index 2866797ee..d9ffca478 100644
--- a/appc-config/appc-encryption-tool/provider/pom.xml
+++ b/appc-config/appc-encryption-tool/provider/pom.xml
@@ -65,9 +65,20 @@
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
         </dependency>
+        <dependency>
+         <groupId>ch.qos.logback</groupId>
+         <artifactId>logback-classic</artifactId>
+	 <version>${logback.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.att.eelf</groupId>
             <artifactId>eelf-core</artifactId>
+            <exclusions>
+                 <exclusion>
+                     <groupId>ch.qos.logback</groupId>
+                     <artifactId>logback-classic</artifactId>
+                 </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>commons-configuration</groupId>
diff --git a/appc-config/appc-flow-controller/provider/pom.xml b/appc-config/appc-flow-controller/provider/pom.xml
index f3cd09b89..065b3be22 100644
--- a/appc-config/appc-flow-controller/provider/pom.xml
+++ b/appc-config/appc-flow-controller/provider/pom.xml
@@ -68,9 +68,20 @@
             <groupId>com.fasterxml.jackson.dataformat</groupId>
             <artifactId>jackson-dataformat-yaml</artifactId>
         </dependency>
+        <dependency>
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-classic</artifactId>
+	    <version>${logback.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.att.eelf</groupId>
             <artifactId>eelf-core</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>ch.qos.logback</groupId>
+                    <artifactId>logback-classic</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.onap.ccsdk.sli.adaptors</groupId>
@@ -141,7 +152,8 @@
                         <Bundle-SymbolicName>org.onap.appc.flow.controller</Bundle-SymbolicName>
                         <Bundle-Activator>org.onap.appc.flow.controller.FlowControllerActivator</Bundle-Activator>
                         <Export-Package>org.onap.appc.flow.controller</Export-Package>
-                        <Import-Package>*</Import-Package>
+                        <Import-Package>groovy.lang;resolution:=optional,
+                            org.codehaus.groovy.*;resolution:=optional,*</Import-Package>
                         <Embed-Dependency>eelf-core,logback-core,logback-classic</Embed-Dependency>
                         <DynamicImport-Package>*</DynamicImport-Package>
                     </instructions>
-- 
cgit 1.2.3-korg