You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@beam.apache.org by "Beam JIRA Bot (Jira)" <ji...@apache.org> on 2021/11/01 17:25:01 UTC
[jira] [Commented] (BEAM-12833) grpc-testing should be decoupled
from beam-vendor-grpc as a separate test only artifact
[ https://issues.apache.org/jira/browse/BEAM-12833?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17436943#comment-17436943 ]
Beam JIRA Bot commented on BEAM-12833:
--------------------------------------
This issue is P2 but has been unassigned without any comment for 60 days so it has been labeled "stale-P2". If this issue is still affecting you, we care! Please comment and remove the label. Otherwise, in 14 days the issue will be moved to P3.
Please see https://beam.apache.org/contribute/jira-priorities/ for a detailed explanation of what these priorities mean.
> grpc-testing should be decoupled from beam-vendor-grpc as a separate test only artifact
> ---------------------------------------------------------------------------------------
>
> Key: BEAM-12833
> URL: https://issues.apache.org/jira/browse/BEAM-12833
> Project: Beam
> Issue Type: Bug
> Components: sdk-java-core
> Reporter: Luke Cwik
> Priority: P2
> Labels: stale-P2
>
> grpc-testing includes potential security flaws as flagged by veracode within TestUtils.java
> Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') (CWE ID 757)
> Description
> A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.
> Effort to Fix: 1 - Trivial implementation error. Fix is up to 5 lines of code. One hour or less to fix.
> Recommendations
> Do not support SSLv2 or weak SSL/TLS ciphers (i.e. 56-bit key length or less, or other inherent weaknesses).
> org/apache/beam/vendor/grpc/v1p36p0/io/grpc/testing/TestUtils.java#136
> org/apache/beam/vendor/grpc/v1p36p0/io/grpc/internal/testing/TestUtils.java#231
> Moving grpc-testing to its own vendored library that can only be brought in at the test scope would address these security issues. Alternatively fix the upstream implementations removing the code.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)