Re: [ee4j-pmc] Fwd: Your GitHub security alerts for the week of Oct 23 -

[Mark Thomas <markt@xxxxxxxxxx>]

On 31/10/2018 17:48, Bill Shannon wrote:
> False positive in what sense?
> 
> The projects don't actually have the dependency?

Of a form. We often see reports for dependencies that are not present at
run time. For example, it is a build-time dependency used to generate
static web content.

> The dependency doesn't actually have the security vulnerability?

No.

> The security vulnerability doesn't actually impact the dependent project?

This one too. We ran a trial a few years ago with a static analysis tool
that, when it found a vulnerable dependency, dug deeper and looked to
see if the application actually used the vulnerable code path. In a
fairly small sample (~ 10 projects) we found that the vulnerable code
path was executed in only around 10% of cases. We didn't do the further
manual research to determine how many of those uses resulted in
vulnerabilities in the application but I'd be surprised if it was more
than 50%.

If you take all of these factors together you tend to get a false
positive rate well in excess of 95%.

> I know at Oracle our approval process assumes the vulnerability is relevant
> unless we can show otherwise.  It's often easier to update the dependency
> than to prove that it's not necessary.

Approaches vary across ASF projects. It tends to vary based on how
conservative they are about updating dependencies.

The ASF security team passes them to the relevant project but doesn't
then track what - if anything - the project decides to do with them.

I tend to view reports like this more as a general reminder to review
the dependencies for updates on a regular basis.

Mark


> 
> 
> Mark Thomas wrote on 10/31/2018 10:40 AM:
>> You have to be an org admin.
>>
>> Experience at the ASF is that they are mostly noise due to a high false positive
>> rate.
>>
>> Mark
>>
>>
>> On 31/10/2018 17:24, Bill Shannon wrote:
>>> I'm not sure who gets these.  You may have to be a Committer on the project or
>>> an admin for the organization.
>>>
>>> Steve Millidge (Payara) wrote on 10/31/2018 02:24 AM:
>>>> Security alerts on GitHub
>>>>
>>>> I don’t get these at a PMC level.
>>>>
>>>> *From:*ee4j-pmc-bounces@xxxxxxxxxxx <ee4j-pmc-bounces@xxxxxxxxxxx> *On Behalf
>>>> Of *Bill Shannon
>>>> *Sent:* 30 October 2018 23:55
>>>> *To:* EE4J PMC Discussions <ee4j-pmc@xxxxxxxxxxx>
>>>> *Subject:* [ee4j-pmc] Fwd: Your GitHub security alerts for the week of Oct 23
>>>> - Oct 30
>>>>
>>>> Is anyone on the PMC tracking these security alerts?
>>>>
>>>> Shouldn't someone ensure that the EE4J projects are responding to these in a
>>>> timely manner?
>>>>
>>>>
>>>> (Obviously ignore the "javaee" entries below.)
>>>>
>>>>
>>>> -------- Forwarded Message --------
>>>>
>>>> *Subject: *
>>>>
>>>>     
>>>>
>>>> Your GitHub security alerts for the week of Oct 23 - Oct 30
>>>>
>>>> *Date: *
>>>>
>>>>     
>>>>
>>>> Tue, 30 Oct 2018 17:36:28 +0000 (UTC)
>>>>
>>>> *From: *
>>>>
>>>>     
>>>>
>>>> GitHub <noreply@xxxxxxxxxx> <mailto:noreply@xxxxxxxxxx>
>>>>
>>>> *To: *
>>>>
>>>>     
>>>>
>>>> Bill Shannon <bill.shannon@xxxxxxxxxx> <mailto:bill.shannon@xxxxxxxxxx>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>     
>>>>
>>>> Explore this week on GitHub
>>>>
>>>> GitHub security alerts__
>>>>
>>>>
>>>>   GitHub <https://github.com> security alert digest
>>>>
>>>> *bshannon’s*repository security updates from the week of *Oct 23 - Oct 30*
>>>>
>>>> <https://github.com>
>>>>
>>>>     
>>>>
>>>>
>>>>       Java EE organization <https://github.com>
>>>>
>>>> Warning!
>>>>
>>>>     
>>>>
>>>>
>>>>       javaee / *metro-jaxws-commons*
>>>>       <https://github.com/javaee/metro-jaxws-commons>
>>>>
>>>> *Known security vulnerabilities detected*
>>>>
>>>> Dependencyorg.springframework:spring-core
>>>>
>>>>     
>>>>
>>>> Version> 3.2.0 < 3.2.15
>>>>
>>>>     
>>>>
>>>> Upgrade to~> 3.2.15
>>>>
>>>> Vulnerabilities
>>>>
>>>> CVE-2015-5211 High severity
>>>>
>>>> CVE-2018-1270 High severity
>>>>
>>>> CVE-2018-1275 High severity
>>>>
>>>> CVE-2015-3192 Moderate severity
>>>>
>>>> CVE-2016-5007 Moderate severity
>>>>
>>>> View 3 more
>>>> <https://github.com/javaee/metro-jaxws-commons/network/alert/spring/spring-core/pom.xml/org.springframework:spring-core/open>
>>>>
>>>>
>>>>     
>>>>
>>>> Defined inpom.xml
>>>>
>>>>     
>>>>
>>>>
>>>>     
>>>>
>>>> *Review all vulnerable dependencies*
>>>> <https://github.com/javaee/metro-jaxws-commons/network/alerts>
>>>>
>>>> Warning!
>>>>
>>>>     
>>>>
>>>>
>>>>       javaee / *javadb* <https://github.com/javaee/javadb>
>>>>
>>>> *Known security vulnerabilities detected*
>>>>
>>>> Dependencyorg.apache.axis:axis
>>>>
>>>>     
>>>>
>>>> Version<= 1.4
>>>>
>>>>     
>>>>
>>>> Vulnerabilities
>>>>
>>>> CVE-2014-3596 Moderate severity
>>>>
>>>> CVE-2018-8032 Moderate severity
>>>>
>>>>     
>>>>
>>>> Defined inpom.xml
>>>>
>>>>     
>>>>
>>>>
>>>>     
>>>>
>>>> *Review all vulnerable dependencies*
>>>> <https://github.com/javaee/javadb/network/alerts>
>>>>
>>>> Warning!
>>>>
>>>>     
>>>>
>>>>
>>>>       javaee / *external* <https://github.com/javaee/external>
>>>>
>>>> *Known security vulnerabilities detected*
>>>>
>>>> Dependencyorg.apache.axis:axis
>>>>
>>>>     
>>>>
>>>> Version<= 1.4
>>>>
>>>>     
>>>>
>>>> Vulnerabilities
>>>>
>>>> CVE-2014-3596 Moderate severity
>>>>
>>>> CVE-2018-8032 Moderate severity
>>>>
>>>>     
>>>>
>>>> Defined inpom.xml
>>>>
>>>>     
>>>>
>>>>
>>>>     
>>>>
>>>> *Review all vulnerable dependencies*
>>>> <https://github.com/javaee/external/network/alerts>
>>>>
>>>> <https://github.com>
>>>>
>>>>     
>>>>
>>>>
>>>>       Eclipse EE4J organization <https://github.com>
>>>>
>>>> Warning!
>>>>
>>>>     
>>>>
>>>>
>>>>       eclipse-ee4j / *tyrus* <https://github.com/eclipse-ee4j/tyrus>
>>>>
>>>> *Known security vulnerabilities detected*
>>>>
>>>> Dependencyorg.eclipse.jetty:jetty-server
>>>>
>>>>     
>>>>
>>>> Version< 9.2.25.v20180606
>>>>
>>>>     
>>>>
>>>> Upgrade to~> 9.2.25.v20180606
>>>>
>>>> Vulnerabilities
>>>>
>>>> CVE-2017-7657 Critical severity
>>>>
>>>> CVE-2017-7656 Moderate severity
>>>>
>>>>     
>>>>
>>>> Defined inpom.xml
>>>>
>>>>     
>>>>
>>>>
>>>>     
>>>>
>>>> *Review all vulnerable dependencies*
>>>> <https://github.com/eclipse-ee4j/tyrus/network/alerts>
>>>>
>>>> Warning!
>>>>
>>>>     
>>>>
>>>>
>>>>       eclipse-ee4j / *grizzly-ahc*
>>>>       <https://github.com/eclipse-ee4j/grizzly-ahc>
>>>>
>>>> *Known security vulnerabilities detected*
>>>>
>>>> Dependencyorg.eclipse.jetty:jetty-server
>>>>
>>>>     
>>>>
>>>> Version>= 9.4.0 < 9.4.11.v20180605
>>>>
>>>>     
>>>>
>>>> Upgrade to~> 9.4.11.v20180605
>>>>
>>>> Vulnerabilities
>>>>
>>>> CVE-2018-12538 Moderate severity
>>>>
>>>> CVE-2018-12536 Moderate severity
>>>>
>>>> CVE-2017-7656 Moderate severity
>>>>
>>>>     
>>>>
>>>> Defined inpom.xml
>>>>
>>>>     
>>>>
>>>>
>>>>     
>>>>
>>>> *Review all vulnerable dependencies*
>>>> <https://github.com/eclipse-ee4j/grizzly-ahc/network/alerts>
>>>>
>>>> /Always verify the validity and compatibility of suggestions with your
>>>> codebase. /
>>>>
>>>> ------------------------------------------------------------------------
>>>>
>>>> Unsubscribe
>>>> <https://github.com/email/unsubscribe?token=AAKLo8HMACwtuFae2pc5lUHVqhk50Feqks5ducoagaRuYW1lrXZ1bG5lcmFiaWxpdHk%3D>
>>>> · Email preferences <https://github.com/settings/emails> · Terms
>>>> <https://help.github.com/articles/github-terms-of-service> · Privacy
>>>> <https://help.github.com/articles/github-privacy-policy> · Sign into GitHub
>>>> <https://github.com/login>
>>>>
>>>> GitHub, Inc.
>>>> 88 Colin P Kelly Jr St.
>>>> San Francisco, CA 94107
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> ee4j-pmc mailing list
>>>> ee4j-pmc@xxxxxxxxxxx
>>>> To change your delivery options, retrieve your password, or unsubscribe from
>>>> this list, visit
>>>> https://www.eclipse.org/mailman/listinfo/ee4j-pmc
>>>
>>>
>>>
>>> _______________________________________________
>>> ee4j-pmc mailing list
>>> ee4j-pmc@xxxxxxxxxxx
>>> To change your delivery options, retrieve your password, or unsubscribe from
>>> this list, visit
>>> https://www.eclipse.org/mailman/listinfo/ee4j-pmc
>>>
>> _______________________________________________
>> ee4j-pmc mailing list
>> ee4j-pmc@xxxxxxxxxxx
>> To change your delivery options, retrieve your password, or unsubscribe from
>> this list, visit
>> https://www.eclipse.org/mailman/listinfo/ee4j-pmc