Giters

sscarduzio / elasticsearch-readonlyrest-plugin

Free Elasticsearch security plugin and Kibana security plugin: super-easy Kibana multi-tenancy, Encryption, Authentication, Authorization, Auditing

Home Page:https://readonlyrest.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

CVE vulnerabilities during scan of RoR plugin

esmierciakSR opened this issue · comments

commented

CVE® is a list of entries—each containing an identification number, a description, and at least one public reference—for publicly known cybersecurity vulnerabilities.

https://cve.mitre.org/

In our use of the RoR plugin, our scanning of the plugin when part of a Docker image detected the following CVE vulnerabilities:

image
image
image

commented

HI @esmierciakSR what version of ES did you scan? You know, netty and jackson are ES dependencies and we cannot do much with it

commented

This was ES 7.9.1, packaged with the corresponding RoR for 7.9.1

The fix for most of the vulnerabilities would be to upgrade netty and jackson libraries to their latest version. For instance the latest version of jackson is 2.11.2 I think.

commented

ok, seems that we can upgrade some of netty and jackson dependencies. Will let you know when it's done

commented

Just checking in on this. Any prediction as to when there will be a release of RoR that includes these dependency updates?

commented

@esmierciakSR it is going to be a part of ROR 1.25.0. We release once a month. Next release will be in November. But when it's ready, I'll send you a pre-build of 1.25.0 to test.

commented

@esmierciakSR it is going to be a part of ROR 1.25.0. We release once a month. Next release will be in November. But when it's ready, I'll send you a pre-build of 1.25.0 to test.

Thanks for the update. Look forward to it.