You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@guacamole.apache.org by "Inperpetuammemoriam (via GitHub)" <gi...@apache.org> on 2023/06/09 20:56:10 UTC
[GitHub] [guacamole-client] Inperpetuammemoriam opened a new pull request, #884: Update Java dependencies to patched versions
Inperpetuammemoriam opened a new pull request, #884:
URL: https://github.com/apache/guacamole-client/pull/884
These changes should address the following (potentially relevant) vulnerabilities:
- CVE-2022-21724
- CVE-2022-26520
- CVE-2022-31197
- CVE-2022-40151
- CVE-2022-40152
- CVE-2022-41946
- CVE-2023-20861
- CVE-2023-20862
- CVE-2023-20863
- GHSA-673j-qm5f-xpv8
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-client] mike-jumper merged pull request #884: GUACAMOLE-1806: Update Java dependencies to patched versions
Posted by "mike-jumper (via GitHub)" <gi...@apache.org>.
mike-jumper merged PR #884:
URL: https://github.com/apache/guacamole-client/pull/884
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-client] mike-jumper commented on a diff in pull request #884: GUACAMOLE-1806: Update Java dependencies to patched versions
Posted by "mike-jumper (via GitHub)" <gi...@apache.org>.
mike-jumper commented on code in PR #884:
URL: https://github.com/apache/guacamole-client/pull/884#discussion_r1225431483
##########
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/pom.xml:
##########
@@ -74,6 +74,23 @@
<groupId>com.onelogin</groupId>
<artifactId>java-saml</artifactId>
<version>2.9.0</version>
+ <!--
+ Replace vulnerable version of Woodstox until upstream
+ releases a version with fixed dependencies
+ -->
+ <exclusions>
+ <exclusion>
+ <groupId>com.fasterxml.woodstox</groupId>
+ <artifactId>woodstox-core</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+
+ <!-- Woodstox -->
+ <dependency>
+ <groupId>com.fasterxml.woodstox</groupId>
+ <artifactId>woodstox-core</artifactId>
+ <version>5.4.0</version>
Review Comment:
I believe the upstream SAML library corrected this by updating their version of xmlsec, and the change there is minimal:
https://github.com/SAML-Toolkits/java-saml/pull/377
We could do that instead of overriding Woodstox, and trust that the change is equivalent to what java-saml has done but not released.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-client] necouchman commented on a diff in pull request #884: GUACAMOLE-1806: Update Java dependencies to patched versions
Posted by "necouchman (via GitHub)" <gi...@apache.org>.
necouchman commented on code in PR #884:
URL: https://github.com/apache/guacamole-client/pull/884#discussion_r1225297121
##########
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/pom.xml:
##########
@@ -74,6 +74,23 @@
<groupId>com.onelogin</groupId>
<artifactId>java-saml</artifactId>
<version>2.9.0</version>
+ <!--
+ Replace vulnerable version of Woodstox until upstream
+ releases a version with fixed dependencies
+ -->
+ <exclusions>
+ <exclusion>
+ <groupId>com.fasterxml.woodstox</groupId>
+ <artifactId>woodstox-core</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+
+ <!-- Woodstox -->
+ <dependency>
+ <groupId>com.fasterxml.woodstox</groupId>
+ <artifactId>woodstox-core</artifactId>
+ <version>5.4.0</version>
Review Comment:
Was this change thoroughly tested to make sure that the SAML library functions as expected with this dependency being swapped out from under it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-client] Inperpetuammemoriam commented on a diff in pull request #884: GUACAMOLE-1806: Update Java dependencies to patched versions
Posted by "Inperpetuammemoriam (via GitHub)" <gi...@apache.org>.
Inperpetuammemoriam commented on code in PR #884:
URL: https://github.com/apache/guacamole-client/pull/884#discussion_r1225462276
##########
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/pom.xml:
##########
@@ -74,6 +74,23 @@
<groupId>com.onelogin</groupId>
<artifactId>java-saml</artifactId>
<version>2.9.0</version>
+ <!--
+ Replace vulnerable version of Woodstox until upstream
+ releases a version with fixed dependencies
+ -->
+ <exclusions>
+ <exclusion>
+ <groupId>com.fasterxml.woodstox</groupId>
+ <artifactId>woodstox-core</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+
+ <!-- Woodstox -->
+ <dependency>
+ <groupId>com.fasterxml.woodstox</groupId>
+ <artifactId>woodstox-core</artifactId>
+ <version>5.4.0</version>
Review Comment:
Correct me, if I'm wrong: Would updating xmlsec to 2.3.0 not also mean to update woodstox-core to 6.2.6? That seems to be an even bigger change.
The version 6.2.6 of woodstox-core furthermore contains the following vulnerabilities that version 5.4.0 does not:
- CVE-2022-40156
- CVE-2022-40155
- CVE-2022-40154
- CVE-2022-40153
- CVE-2022-40152
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-client] Inperpetuammemoriam commented on a diff in pull request #884: GUACAMOLE-1806: Update Java dependencies to patched versions
Posted by "Inperpetuammemoriam (via GitHub)" <gi...@apache.org>.
Inperpetuammemoriam commented on code in PR #884:
URL: https://github.com/apache/guacamole-client/pull/884#discussion_r1225322110
##########
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/pom.xml:
##########
@@ -74,6 +74,23 @@
<groupId>com.onelogin</groupId>
<artifactId>java-saml</artifactId>
<version>2.9.0</version>
+ <!--
+ Replace vulnerable version of Woodstox until upstream
+ releases a version with fixed dependencies
+ -->
+ <exclusions>
+ <exclusion>
+ <groupId>com.fasterxml.woodstox</groupId>
+ <artifactId>woodstox-core</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+
+ <!-- Woodstox -->
+ <dependency>
+ <groupId>com.fasterxml.woodstox</groupId>
+ <artifactId>woodstox-core</artifactId>
+ <version>5.4.0</version>
Review Comment:
I built a simple container environment including a SAML Identity Provider (Keycloak) and was still able to perform a login.
Just to be clear: I am far away from being an expert. So any advice on getting this done the right way is highly appreciated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-client] Inperpetuammemoriam commented on pull request #884: GUACAMOLE-1806: Update Java dependencies to patched versions
Posted by "Inperpetuammemoriam (via GitHub)" <gi...@apache.org>.
Inperpetuammemoriam commented on PR #884:
URL: https://github.com/apache/guacamole-client/pull/884#issuecomment-1585181720
> Are there any other dependencies that can and should be updated here?
There are two more Java dependencies that should be taken care of in one way or another. (see [GUACAMOLE-1806](https://issues.apache.org/jira/browse/GUACAMOLE-1806))
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [guacamole-client] mike-jumper commented on a diff in pull request #884: GUACAMOLE-1806: Update Java dependencies to patched versions
Posted by "mike-jumper (via GitHub)" <gi...@apache.org>.
mike-jumper commented on code in PR #884:
URL: https://github.com/apache/guacamole-client/pull/884#discussion_r1225699408
##########
extensions/guacamole-auth-sso/modules/guacamole-auth-sso-saml/pom.xml:
##########
@@ -74,6 +74,23 @@
<groupId>com.onelogin</groupId>
<artifactId>java-saml</artifactId>
<version>2.9.0</version>
+ <!--
+ Replace vulnerable version of Woodstox until upstream
+ releases a version with fixed dependencies
+ -->
+ <exclusions>
+ <exclusion>
+ <groupId>com.fasterxml.woodstox</groupId>
+ <artifactId>woodstox-core</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+
+ <!-- Woodstox -->
+ <dependency>
+ <groupId>com.fasterxml.woodstox</groupId>
+ <artifactId>woodstox-core</artifactId>
+ <version>5.4.0</version>
Review Comment:
Oof, yeah - good catch and never mind. Bigger change is not necessarily bad for a dependency we don't directly use ourselves (presumably the library using it has already tested their own compatibility), but we definitely don't want to pull in new issues.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@guacamole.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org