[WFLY-18073] Add the OWASP dependency-check plugin to the WildFly build. #17686

darranl · 2024-03-04T17:15:53Z

I am raising this as a draft whilst I put together some documentation but in the meantime it should be possible to experiment with the plugin.

https://issues.redhat.com/browse/WFLY-18073

The plugin does not run by default, also at the moment it is not possible to run in CI due to rate limiting of the vulnerability database APIs but after the first run subsequent local runs are very fast to generate a report on-demand.

Before running you will need a personal API key from NVD, this can be obtained by submitting the following form:

https://nvd.nist.gov/developers/request-an-api-key

This API key will need adding to your Maven settings.xml:

    <server>
        <id>nvd</id>
        <password>XXX</password>
    </server>

Run a mvn install build of WildFly as normal so that any dependencies are downloaded and the artefacts of the build installed to your local maven repo.

The following command can be used to generate a report:

mvn -Ddependency-check dependency-check:aggregate

The report will be found in wildfly/target/dependency-check-report.html which you can open in your local browser.

To suppress false positives entries are added to the new sca-overrides/owasp-suppressions.xml file. There are two approaches which we can use to suppress a report, we can suppress the exact CVE against or a component or we can suppress how the component was matched.

Although vulnerabilities are suppressed it is possible in the report to see these to double check.

A further challenge will be mapping of false negatives, if we identify vulnerabilities in components which are not picked up we will need to triage.

<--- THIS SECTION IS AUTOMATICALLY GENERATED BY WILDFLY GITHUB BOT. ANY MANUAL CHANGES WILL BE LOST. --->

Wildfly issue links:

WFLY-19022

WFLY-19088

<--- END OF WILDFLY GITHUB BOT REPORT --->

More information about the wildfly-bot[bot]

… only used for tests.

… grpc-go

… a vulnerability.

…tEasy so don't associate with the RestEasy CPE.

…y associating the CallbackHandler with a ThreadLocal.

…as this applies to the top level jgroups project. This is not a CPE supression as CVEs raised against this artefact could use a similar CPE.

…a ApacheDS for testing.

…to WildFly.

…press is a test dependency via testcontainer.

…nts such as Python and Go.

…3.1:*:*:*:*:*:*:* as this is a bad match for Elytron.

…self not these separate projects.

…t's own fix.

…dfly CPE.

… so add supressions.

…h cpe redhat:wildfly.

…ldfly CPE.

1. It is not matched against the correct components. 2. It was decided this is not a CVE and is the user's responsibility.

the affected functionality has also been removed from RestEasy already.

darranl · 2024-04-02T10:43:31Z

@bstansberry as this is an independent build profile I have set as ready to review.

bstansberry · 2024-04-02T13:54:05Z

sca-overrides/owasp-suppressions.xml

+      <notes><![CDATA[
+      file name: commons-compress-1.24.0.jar
+      ]]></notes>
+      <packageUrl regex="true">^pkg:maven/org\.apache\.commons/commons\-compress@.*$</packageUrl>


Should this have a comment?

Perhaps "Not used in a WildFly installation"

bstansberry · 2024-04-02T13:54:42Z

sca-overrides/owasp-suppressions.xml

+      <notes><![CDATA[
+      file name: mina-core-2.1.3.jar
+      ]]></notes>
+      <packageUrl regex="true">^pkg:maven/org\.apache\.mina/mina\-core@.*$</packageUrl>


Should this have a comment?

bstansberry · 2024-04-02T13:55:15Z

sca-overrides/owasp-suppressions.xml

+      file name: jakarta.security.enterprise-3.0.3.jar
+      ]]></notes>
+      <packageUrl regex="true">^pkg:maven/org\.glassfish\.soteria/jakarta\.security\.enterprise@.*$</packageUrl>
+      <vulnerabilityName>CVE-2020-1732</vulnerabilityName>


Should this have a comment?

bstansberry

@darranl This LGTM except some of the suppressions could use a comment, if possible.

I ignored some that don't have a comment where the CVE is before 2020

darranl · 2024-04-02T13:57:16Z

@bstansberry before you add too many "Should this have a comment?" comments - this is why you see in the PR quite a few commits - git annotated can be used on this file to identify why each block was added.

But can add comments as well if you prefer.

bstansberry

I think further comments can be added later.

bstansberry · 2024-04-02T17:31:47Z

Thanks @darranl

darranl added 30 commits February 9, 2024 12:49

[WFLY-18073] Add the OWASP Dependency Check Plugin

71d0344

[WFLY-18073] Add a supression file and start by excluding ApacheDS as…

1d8884e

… only used for tests.

[WFLY-18073] Add CPE supressions for the Artemis integration artefact.

d3dbd10

Merge branch 'WFLY-19022' into WFLY-18073

939696e

[WFLY-18073] Supress the expressly to glassfish CPE mapping.

56195a1

[WFLY-18073] Supress CVE-2023-44487 against grpc-api as it applies to…

e91589f

… grpc-go

[WDLY-18073] Supress CVE-2018-14335 as rejected by h2database.

98721fe

[WFLY-18073] Supress CVE-2023-35116 as FasterXML dispute that this is…

5688437

… a vulnerability.

[WFLY-18073] This module is the Elytron security integration with Res…

de46a49

…tEasy so don't associate with the RestEasy CPE.

[WFLY-18073] Supressing CVE-2020-1732, we have compensated for this b…

9f090a5

…y associating the CallbackHandler with a ThreadLocal.

[WFLY-18073] The EJB client is different to the IIOP client.

3dd1d53

[WFLY-18073] Supress CVE-2016-2141 when reported against jgroups-aws …

f755360

…as this applies to the top level jgroups project. This is not a CPE supression as CVEs raised against this artefact could use a similar CPE.

[WFLY-18073] Synchronise changes from main.

34147d4

[WFLY-18073] Remove supression rule with no matches.

241d14b

[WFLY-18073] Supress CVE-2021-41973 for mina-core as this comes in vi…

eaf8d1b

…a ApacheDS for testing.

[WFLY-18073] mvc-krazo is a separate project.

dfa23f1

[WFLY-18073] Include nimbus-jose-jwt component upgrade.

0ea95f2

[WFLY-18073] The transformer-api is maintained in a separate project …

1b7eb4a

…to WildFly.

Merge remote-tracking branch 'upstream/main' into WFLY-18073

798dac4

[WFLY-19088] Upgrade Apache James Mime4j to 0.8.10

5018221

Merge branch 'WFLY-19088' into WFLY-18073

e0f3eb6

[WFLY-18073] Supress CVE-2024-25710 and CVE-2024-26308 as commons-com…

375cdb4

…press is a test dependency via testcontainer.

[WFLY-18073] Supress the OTel CVEs as these are against other compone…

6387d4d

…nts such as Python and Go.

[WFLY-18073] Supress CPE cpe:2.3:a:linux_audit_project:linux_audit:2.…

cc31ca9

…3.1:*:*:*:*:*:*:* as this is a bad match for Elytron.

[WFLY-18073] Set of Rest Easy supressions that relate to RestEasy ite…

f33627e

…self not these separate projects.

[WFLY-18073] Supress CVE-2016-6311 for Undertow as WildFly contains i…

dcfd1f2

…t's own fix.

[WFLY-18073] Exclude all WildFly Core components mapped to redhat:wil…

a94fc5f

…dfly CPE.

[WFLY-18073] wildfly-plugins-core is not WildFly and not WildFly Core…

ebf3246

… so add supressions.

[WFLY-18073] The Galleon Plugins transformer artifact should not matc…

ea06db8

…h cpe redhat:wildfly.

[WFLY-18073] Avoid deployment transformer getting mapped to redhat:wi…

63c966f

…ldfly CPE.

darranl added 3 commits March 4, 2024 16:20

[WFLY-18073] Avoid wildfly-galleon-plugins mapping to redhat:wildfly CPE

cedb66a

[WFLY-18073] Move the dependency-check plugin into it's own profile.

e203bef

[WFLY-18073] Correct the name of the suppression file.

7b3d618

github-actions bot added the deps-ok Dependencies have been checked, and there are no significant changes label Mar 4, 2024

darranl mentioned this pull request Mar 4, 2024

[31.x] [WFLY-18073] Add the OWASP dependency-check plugin to the WildFly build. #17687

Open

darranl added 2 commits March 8, 2024 17:23

[WFLY-18073] Ignore CVE-2021-20293 for two reasons:

7d85cd5

1. It is not matched against the correct components. 2. It was decided this is not a CVE and is the user's responsibility.

[WFLY-18073] This CVE should not be matching against resteasy-spring,

529d77d

the affected functionality has also been removed from RestEasy already.

darranl marked this pull request as ready for review April 2, 2024 10:41

darranl added the 32.x WildFly 32 label Apr 2, 2024

bstansberry reviewed Apr 2, 2024

View reviewed changes

bstansberry approved these changes Apr 2, 2024

View reviewed changes

bstansberry merged commit 03559d6 into wildfly:main Apr 2, 2024
15 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WFLY-18073] Add the OWASP dependency-check plugin to the WildFly build. #17686

[WFLY-18073] Add the OWASP dependency-check plugin to the WildFly build. #17686

darranl commented Mar 4, 2024 •

edited by wildfly-bot bot

darranl commented Apr 2, 2024

bstansberry Apr 2, 2024

bstansberry Apr 2, 2024

bstansberry Apr 2, 2024

bstansberry left a comment

darranl commented Apr 2, 2024

bstansberry left a comment

bstansberry commented Apr 2, 2024

[WFLY-18073] Add the OWASP dependency-check plugin to the WildFly build. #17686

[WFLY-18073] Add the OWASP dependency-check plugin to the WildFly build. #17686

Conversation

darranl commented Mar 4, 2024 • edited by wildfly-bot bot

darranl commented Apr 2, 2024

bstansberry Apr 2, 2024

Choose a reason for hiding this comment

bstansberry Apr 2, 2024

Choose a reason for hiding this comment

bstansberry Apr 2, 2024

Choose a reason for hiding this comment

bstansberry left a comment

Choose a reason for hiding this comment

darranl commented Apr 2, 2024

bstansberry left a comment

Choose a reason for hiding this comment

bstansberry commented Apr 2, 2024

darranl commented Mar 4, 2024 •

edited by wildfly-bot bot