aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDan Timoney <dtimoney@att.com>2019-10-23 22:25:04 +0000
committerGerrit Code Review <gerrit@onap.org>2019-10-23 22:25:04 +0000
commitb28e616ea0077c0274c4951b13b09fe1b7e696f3 (patch)
treea5e224bfb8066bc1fbd8cd54ff30f4165d68a320
parentc0070fd86f6db286bc77afc3de50a6a70a5f11f5 (diff)
parent6e81e33474e089e5845da8755e17c29a29197f28 (diff)
Merge "Improve security release notes for El Alto"
Former-commit-id: 2b1b8b28022a6ff53842c8ca513c5922f0c958a0
-rw-r--r--docs/release-notes.rst14
1 files changed, 13 insertions, 1 deletions
diff --git a/docs/release-notes.rst b/docs/release-notes.rst
index 9bfac300..7aae5be0 100644
--- a/docs/release-notes.rst
+++ b/docs/release-notes.rst
@@ -90,20 +90,32 @@ Dublin. These issues have been resolved in El Alto.
*Fixed Security Issues*
- CVE-2019-12132 `OJSI-41 <https://jira.onap.org/browse/OJSI-41>`_ SDNC service allows for arbitrary code execution in sla/dgUpload form
+ Fixed temporarily by disabling admportal.
- CVE-2019-12123 `OJSI-42 <https://jira.onap.org/browse/OJSI-42>`_ SDNC service allows for arbitrary code execution in sla/printAsXml form
+ Fixed temporarily by disabling admportal.
- CVE-2019-12113 `OJSI-43 <https://jira.onap.org/browse/OJSI-43>`_ SDNC service allows for arbitrary code execution in sla/printAsGv form
+ Fixed by removing this API endpoint.
- `OJSI-91 <https://jira.onap.org/browse/OJSI-91>`_ SDNC exposes unprotected API for user creation
+ Fixed temporarily by disabling admportal.
- `OJSI-98 <https://jira.onap.org/browse/OJSI-98>`_ In default deployment SDNC (sdnc-portal) exposes HTTP port 30201 outside of cluster.
+ Port 30201 now uses HTTPS protocol.
- CVE-2019-12112 `OJSI-199 <https://jira.onap.org/browse/OJSI-199>`_ SDNC service allows for arbitrary code execution in sla/upload form
+ Fixed temporarily by disabling admportal.
- `OJSI-34 <https://jira.onap.org/browse/OJSI-34>`_ Multiple SQL Injection issues in SDNC
- `OJSI-99 <https://jira.onap.org/browse/OJSI-99>`_ In default deployment SDNC (sdnc) exposes HTTP port 30202 outside of cluster.
+ Port 30202 is no longer used.
- `OJSI-100 <https://jira.onap.org/browse/OJSI-100>`_ In default deployment SDNC (sdnc-dgbuilder) exposes HTTP port 30203 outside of cluster.
+ Port 30203 now uses HTTPS protocol.
- `OJSI-179 <https://jira.onap.org/browse/OJSI-179>`_ dev-sdnc-sdnc exposes JDWP on port 1830 which allows for arbitrary code execution
+ Ticket has been closed as no one was able to reproduce the issue.
- `OJSI-183 <https://jira.onap.org/browse/OJSI-183>`_ SDNC exposes ssh service on port 30208
+ Port 30202 is no longer used.
*Known Security Issues*
-
+For CVE-2019-12132, CVE-2019-12123 and CVE-2019-12112 only temporary fix has been applied.
+This fix simply prevents admportal from being started and exposed.
+If admportal is to be used in your deployment, please be very cautious and remember to fix those vulnerabilities on your own.
*Known Vulnerabilities in Used Modules*