You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@dolphinscheduler.apache.org by "dill21yu (via GitHub)" <gi...@apache.org> on 2025/11/26 07:26:26 UTC
[I] [Improvement][Dependency][Security] Disable JDWP remote debug listeners in production [dolphinscheduler]
dill21yu opened a new issue, #17737:
URL: https://github.com/apache/dolphinscheduler/issues/17737
### Search before asking
- [x] I had searched in the [issues](https://github.com/apache/dolphinscheduler/issues?q=is%3Aissue) and found no similar feature requirement.
### Description
Part of #15940
**Vulnerability name**: JDWP unauthorized access (configuration/runtime risk)
**Category**: Unauthorized access / runtime configuration
Affected components/modules (please fill):
- Check Dockerfiles, container entrypoints, Kubernetes manifests/Helm charts, systemd unit files and CI/CD pipeline scripts in directories such as `docker/`, `deploy/`, `helm/`, etc.
## Description
JDWP (Java Debug Wire Protocol) is used for remote debugging of JVM applications. If JDWP is enabled and listening on a network interface exposed to untrusted networks (for example via JVM args like `-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005`), attackers can connect to the JVM debug port and perform actions including reading/modifying memory, executing code, or hijacking the process. This is a configuration vulnerability rather than a code CVE.
## Recommended fix
- Remove JDWP / remote debug JVM arguments from production images and deployment start commands.
- If remote debugging is required for narrow cases, bind the debug listener to `localhost` (127.0.0.1) and restrict access to trusted networks only.
- Add CI checks that scan built images and deployment artifacts for presence of JDWP-related JVM options (`jdwp`, `agentlib`, `transport=dt_socket`, etc.).
- Update deployment documentation and runbooks to warn against enabling JDWP in production.
## References
- Parent tracking issue: #15940
### Are you willing to submit a PR?
- [x] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Improvement][Security] Disable JDWP remote debug listeners in production [dolphinscheduler]
Posted by "dill21yu (via GitHub)" <gi...@apache.org>.
dill21yu closed issue #17737: [Improvement][Security] Disable JDWP remote debug listeners in production
URL: https://github.com/apache/dolphinscheduler/issues/17737
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Improvement][Security] Disable JDWP remote debug listeners in production [dolphinscheduler]
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS commented on issue #17737:
URL: https://github.com/apache/dolphinscheduler/issues/17737#issuecomment-3579874028
DS don't provide JDWP related jvm args by default. Why did this become CVE?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Improvement][Security] Disable JDWP remote debug listeners in production [dolphinscheduler]
Posted by "dill21yu (via GitHub)" <gi...@apache.org>.
dill21yu commented on issue #17737:
URL: https://github.com/apache/dolphinscheduler/issues/17737#issuecomment-3579894988
> DS don't provide JDWP related jvm args by default. Why did this become CVE?
Sorry, I made a mistake — this issue isn't related to DS. DS doesn't enable JDWP by default, so it's not a CVE. I'll close this issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org