Third party libraries known CVE issues

azure-identity-*.jar

Azure Identity SDK Remote Code Execution Vulnerability

Above is the only information supplied

For the current 1.11.0 version we consider this a false alert for a vulnerability that needs to be addressed in the .net based Azure SDK. so it will be suppressed, specifically for CVE-2023-36415

2021.02 - current

zlib1.dll

libz.so.1.2.13

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product.

The main author, Mark Adler states (github):
Minizip is not part of zlib. The source code is provided in the contrib directory of the zlib distribution, along with several other such contributions, as a courtesy. This is not a zlib vulnerability.
Additionally, zlib.def has been checked to verify that at least the windows version contains no minizip methods.

2022.02 - current

False positive, no action required.

netty-transport-4.1.91.Final.jar

netty-all-4.1.79.Final.jar

A vulnerability was found in the Hot Rod client provided by the Netty library. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.
Netty is used by FEWS in the context of Microsoft Azure (AzureIotHub import) and THREDDS which is used by the archive server.

Hot Rod is a very specific TCP client server protocol used by the Jboss Infinispan product. There is no indication of any kind that the Hot Rod protocol is used by FEWS or THREDDS in any way so this is considered a false positive warning.

2020.02 - current

False positive. No action required.
There is no indication of any kind that the Hot Rod protocol is used by FEWS or THREDDS in any way.

spring-boot-3.0.7.jar

In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers. Specifically, an application is vulnerable when all of the following are true: * The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record * The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true. * The user allows untrusted sources to publish to a Kafka topic By default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.

False positive. No action required.

Two out of three conditions mentioned in the description are not met in the case of FEWS. This library is currently only used for the admin interface, which should never be made available for use by "untrusted sources" over the internet.

quartz-jobs 2.3.2

quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute.
This vulnerability is exploited via passing an unchecked argument.
This is a indirect dependency as this library is used by the THREDDS data service which is part of the archive. The source code of the current 4.6 THREDDS release has been checked to make sure that this does not use the SendQueueMessageJob class in any way so it is considered a false positive within the context of FEWS.

2022.02 - current

False positive. No action required.
FEWS only uses this to implement OpenGIS WFS viewing capability, no server side WFS or FES implementation that could be prone to SQL injection exists in FEWS.

jackson-databind-2.13.4.2.jar (upto 2.15.2

2021.02 - current

False positive. No action required
It can be exploited only by reverse engineering the FEWS binaries.

gt-26.4.jar
gt-20.0.jar
net.opengis.fes-20.0.jar

2019-02 -
2022.02

Feb 2023

August 2022

postgresql-42.4.1.jar

postgresql-42.3.3.jar

PG 42.3.3 was flagged in Aug 2022.

PG 42.4.1 was flagged only since Feb 2023.

The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column names so a malicious column name that contains a statement terminator, e.g. `;`, could lead to SQL injection. 

2022.01 - 2022.02

False positive. 2022.02 and 2023.01 have been upgraded to 42.5.3.

The spring framework allows to use a http invoker that uses object serialization that may be vulnerable for Remote Code Execution.

https://docs.spring.io/spring-framework/docs/current/reference/html/integration.html#remoting-httpinvoker. 

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.

Comment of Thymeleaf developer: I'd like to explain that CVE-2021-43466 only affects those applications that contain controllers or controller configurations that take a request parameter and directly use it, without previous filtering, as the name of the view to be rendered

CVE-2021-42340,

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.

The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.

CVE-2021-37136,

CVE-2021-37137

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack.

and

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

Dependency of ucar netcdf libraries. JDOM  library has been upgraded to: jdom2-2.0.6.1.jar since 2022.01.

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
CWE-863 Incorrect Authorization

Up to 2022-03-24

CVE-2023-2976

CVE-2020-13936

FEWS-29331,FEWS-29332, FEWS-29334 and FEWS-29335

FEWS-29336

CVE-2022-3171

FEWS-29337

CVE-2022-45688

FEWS-29340 and FEWS-29342

CVE-2021-33813

FEWS-29346

CVE-2019-20444

CVE-2022-3064

FEWS-24730

CVE-2023-42795

When recycling various internal objects, including the request and the response, prior to re-use by the next request/response, an error could cause Tomcat to skip some parts of the recycling process leading to information leaking from the current request/response to the next.

• 10.1.0 - 10.1.13
• 9.0.0 - 9.0.80

Upgrade to latest version of Apache Tomcat.

Note: Delft-FEWS releases < 2023.01 require Apache Tomcat 9, release >= 2023.01 require Apache Tomcat 10.

CVE-2023-44487

Tomcat's HTTP/2 implementation was vulnerable to the rapid reset attack.

The denial of service typically manifested as an OutOfMemoryError.

• 10.1.0 - 10.1.13
• 9.0.0 - 9.0.80

Upgrade to latest version of Apache Tomcat.

Note: Delft-FEWS releases < 2023.01 require Apache Tomcat 9, release >= 2023.01 require Apache Tomcat 10.

CVE-2023-45648

Tomcat did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy.

• 10.1.0 - 10.1.13
• 9.0.0 - 9.0.80

Upgrade to latest version of Apache Tomcat.

Note: Delft-FEWS releases < 2023.01 require Apache Tomcat 9, release >= 2023.01 require Apache Tomcat 10.

• Apache Tomcat 10.1.8
• Apache Tomcat 9.0.74

Upgrade to latest version of Apache Tomcat.

Note: Delft-FEWS releases < 2023.01 require Apache Tomcat 9, release >= 2023.01 require Apache Tomcat 10.

• Apache Tomcat 10.1.5 to 10.1.7
• Apache Tomcat 9.0.71 to 9.0.73

Upgrade to latest version of Apache Tomcat.

Note: Delft-FEWS releases < 2023.01 require Apache Tomcat 9, release >= 2023.01 require Apache Tomcat 10.