From 0587da741a0edad6e5eefedbc1d200f0e2c81f2b Mon Sep 17 00:00:00 2001 From: Andreas Geissler Date: Mon, 12 Sep 2022 13:27:04 +0200 Subject: [OOM-CERT-SERVICE] Fix vulnerabilities for Kohn - update gson to 2.9.0 - update commons-io to 2.11.0 - update httpclient to 4.5.13 - update bcprov-jdk15on to 1.70 - left version of sonar-go-pluging at 1.1.1.2000 - fix the implementation in respect to the update - include py3.8 fix (https://gerrit.onap.org/r/c/oom/platform/cert-service/+/130574) Issue-ID: OOM-2985 Signed-off-by: Andreas Geissler Change-Id: I0d6b775c3f09b283900981c49db4abaf80d33b11 --- certService/pom.xml | 4 ++-- .../org/onap/oom/certservice/cmpv2client/impl/CmpMessageHelper.java | 5 +++-- .../main/java/org/onap/oom/certservice/cmpv2client/impl/CmpUtil.java | 5 +++-- .../cmpv2client/validation/CmpResponseValidationHelper.java | 3 ++- 4 files changed, 10 insertions(+), 7 deletions(-) (limited to 'certService') diff --git a/certService/pom.xml b/certService/pom.xml index 13fed005..973da643 100644 --- a/certService/pom.xml +++ b/certService/pom.xml @@ -18,10 +18,10 @@ org.onap.oom.platform.cert-service oom-certservice - 2.5.0-SNAPSHOT + 2.6.0-SNAPSHOT oom-certservice-api - 2.5.0-SNAPSHOT + 2.6.0-SNAPSHOT oom-certservice-api OOM Certification Service Api jar diff --git a/certService/src/main/java/org/onap/oom/certservice/cmpv2client/impl/CmpMessageHelper.java b/certService/src/main/java/org/onap/oom/certservice/cmpv2client/impl/CmpMessageHelper.java index 463451bd..3fac6656 100644 --- a/certService/src/main/java/org/onap/oom/certservice/cmpv2client/impl/CmpMessageHelper.java +++ b/certService/src/main/java/org/onap/oom/certservice/cmpv2client/impl/CmpMessageHelper.java @@ -31,10 +31,11 @@ import java.security.Signature; import java.security.SignatureException; import java.util.Date; +import org.bouncycastle.asn1.ASN1Encoding; import org.bouncycastle.asn1.ASN1EncodableVector; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import org.bouncycastle.asn1.DERBitString; -import org.bouncycastle.asn1.DEROutputStream; +import org.bouncycastle.asn1.ASN1OutputStream; import org.bouncycastle.asn1.DERSequence; import org.bouncycastle.asn1.DERTaggedObject; import org.bouncycastle.asn1.crmf.CertRequest; @@ -127,7 +128,7 @@ public final class CmpMessageHelper { final CertRequest certRequest, final KeyPair keypair) throws CmpClientException { ProofOfPossession proofOfPossession; try (ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream()) { - final DEROutputStream derOutputStream = new DEROutputStream(byteArrayOutputStream); + final ASN1OutputStream derOutputStream = ASN1OutputStream.create(byteArrayOutputStream,ASN1Encoding.DER); derOutputStream.writeObject(certRequest); byte[] popoProtectionBytes = byteArrayOutputStream.toByteArray(); diff --git a/certService/src/main/java/org/onap/oom/certservice/cmpv2client/impl/CmpUtil.java b/certService/src/main/java/org/onap/oom/certservice/cmpv2client/impl/CmpUtil.java index 0d0d7f34..fac4150a 100644 --- a/certService/src/main/java/org/onap/oom/certservice/cmpv2client/impl/CmpUtil.java +++ b/certService/src/main/java/org/onap/oom/certservice/cmpv2client/impl/CmpUtil.java @@ -22,11 +22,12 @@ package org.onap.oom.certservice.cmpv2client.impl; import org.bouncycastle.asn1.ASN1Encodable; +import org.bouncycastle.asn1.ASN1Encoding; import org.bouncycastle.asn1.ASN1EncodableVector; import org.bouncycastle.asn1.ASN1GeneralizedTime; import org.bouncycastle.asn1.ASN1OctetString; +import org.bouncycastle.asn1.ASN1OutputStream; import org.bouncycastle.asn1.DEROctetString; -import org.bouncycastle.asn1.DEROutputStream; import org.bouncycastle.asn1.DERSequence; import org.bouncycastle.asn1.cmp.CMPObjectIdentifiers; import org.bouncycastle.asn1.cmp.InfoTypeAndValue; @@ -116,7 +117,7 @@ public final class CmpUtil { vector.add(body); ASN1Encodable protectedPart = new DERSequence(vector); try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) { - DEROutputStream out = new DEROutputStream(baos); + ASN1OutputStream out = ASN1OutputStream.create(baos,ASN1Encoding.DER); out.writeObject(protectedPart); res = baos.toByteArray(); } catch (IOException ioe) { diff --git a/certService/src/main/java/org/onap/oom/certservice/cmpv2client/validation/CmpResponseValidationHelper.java b/certService/src/main/java/org/onap/oom/certservice/cmpv2client/validation/CmpResponseValidationHelper.java index 90044b66..f3da0f32 100644 --- a/certService/src/main/java/org/onap/oom/certservice/cmpv2client/validation/CmpResponseValidationHelper.java +++ b/certService/src/main/java/org/onap/oom/certservice/cmpv2client/validation/CmpResponseValidationHelper.java @@ -36,6 +36,7 @@ import javax.crypto.spec.SecretKeySpec; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import org.bouncycastle.asn1.DERBitString; +import org.bouncycastle.asn1.ASN1BitString; import org.bouncycastle.asn1.cmp.CMPObjectIdentifiers; import org.bouncycastle.asn1.cmp.InfoTypeAndValue; import org.bouncycastle.asn1.cmp.PBMParameter; @@ -66,7 +67,7 @@ public final class CmpResponseValidationHelper { static void verifySignature(PKIMessage respPkiMessage, PublicKey pk) throws CmpClientException { final byte[] protBytes = getProtectedBytes(respPkiMessage); - final DERBitString derBitString = respPkiMessage.getProtection(); + final DERBitString derBitString = (DERBitString) respPkiMessage.getProtection(); try { final Signature signature = Signature.getInstance( -- cgit 1.2.3-korg