You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@geode.apache.org by "Anthony Baker (Jira)" <ji...@apache.org> on 2022/04/14 15:48:00 UTC
[jira] [Resolved] (GEODE-10236) Compatibility issues while upgrading Jgroups to versions 4.0+
[ https://issues.apache.org/jira/browse/GEODE-10236?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Anthony Baker resolved GEODE-10236.
-----------------------------------
Resolution: Not A Bug
Please see [1]. Geode uses jgroups for reliable UDP transport. The vulnerability exists only for AUTH / ENCRYPT which Geode does not use. This is not a security issue.
I realize that it can be hard when scanners generate false positives like this. However, upgrading to a new major version of JGroups is a large effort and may break Geode guarantees like rolling upgrades. I think it's more likely that we would invest in building a different transport layer for membership messages so that we can control breaking changes introduced by jgroups.
[1] https://lists.apache.org/thread/ymj65x43g2k1ozdckkr92tt8rysrn8wd
> Compatibility issues while upgrading Jgroups to versions 4.0+
> -------------------------------------------------------------
>
> Key: GEODE-10236
> URL: https://issues.apache.org/jira/browse/GEODE-10236
> Project: Geode
> Issue Type: Bug
> Affects Versions: 1.14.4
> Reporter: Rohan Jagtap
> Priority: Major
> Labels: needsTriage
>
> According to a recent CVE:
> {quote}CVE-2016-2141
> NVD: 2016/06/30 - CVSS v2 Base Score: 7.5 - CVSS v3.1 Base Score: 9.8
> JGroups before 4.0 does not require the proper headers for the ENCRYPT and AUTH protocols from nodes joining the cluster, which allows remote attackers to bypass security restrictions and send and receive messages within the cluster via unspecified vectors.
>
> {quote}
> Hence we intend to upgrade jgroups to a recommended version.
> However, even the latest version of apache geode ([geode-core 1.14.4|https://mvnrepository.com/artifact/org.apache.geode/geode-core/1.14.4]) uses jgroups 3.6.14 which has the aforementioned vulnerability.
> Overriding the jgroups dependency to anything over 4.0+ gives the following issue on running:
> {{Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'gemfireCache': FactoryBean threw exception on object creation; nested exception is java.lang.ExceptionInInitializerError}}
> {{ at org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:176)}}
> {{ at org.springframework.beans.factory.support.FactoryBeanRegistrySupport.getObjectFromFactoryBean(FactoryBeanRegistrySupport.java:101)}}
> {{ at org.springframework.beans.factory.support.AbstractBeanFactory.getObjectForBeanInstance(AbstractBeanFactory.java:1828)}}
> {{ at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.getObjectForBeanInstance(AbstractAutowireCapableBeanFactory.java:1265)}}
> {{ at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:334)}}
> {{ at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)}}
> {{ at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveReference(BeanDefinitionValueResolver.java:330)}}
> {{ ... 32 common frames omitted}}
> {{Caused by: java.lang.ExceptionInInitializerError: null}}
> {{ at org.apache.geode.distributed.internal.membership.gms.Services.<init>(Services.java:155)}}
> {{ at org.apache.geode.distributed.internal.membership.gms.MembershipBuilderImpl.create(MembershipBuilderImpl.java:114)}}
> {{ at org.apache.geode.distributed.internal.DistributionImpl.<init>(DistributionImpl.java:150)}}
> {{ at org.apache.geode.distributed.internal.DistributionImpl.createDistribution(DistributionImpl.java:217)}}
> {{ at org.apache.geode.distributed.internal.ClusterDistributionManager.<init>(ClusterDistributionManager.java:464)}}
> {{ at org.apache.geode.distributed.internal.ClusterDistributionManager.<init>(ClusterDistributionManager.java:497)}}
> {{ at org.apache.geode.distributed.internal.ClusterDistributionManager.create(ClusterDistributionManager.java:326)}}
> {{ at org.apache.geode.distributed.internal.InternalDistributedSystem.initialize(InternalDistributedSystem.java:779)}}
> {{ at org.apache.geode.distributed.internal.InternalDistributedSystem.access$200(InternalDistributedSystem.java:135)}}
> {{ at org.apache.geode.distributed.internal.InternalDistributedSystem$Builder.build(InternalDistributedSystem.java:3036)}}
> {{ at org.apache.geode.distributed.internal.InternalDistributedSystem.connectInternal(InternalDistributedSystem.java:290)}}
> {{ at org.apache.geode.distributed.internal.InternalDistributedSystem.connectInternal(InternalDistributedSystem.java:216)}}
> {{ at org.apache.geode.internal.cache.InternalCacheBuilder.createInternalDistributedSystem(InternalCacheBuilder.java:346)}}
> {{ at java.base/java.util.Optional.orElseGet(Optional.java:369)}}
> {{ at org.apache.geode.internal.cache.InternalCacheBuilder.create(InternalCacheBuilder.java:157)}}
> {{ at org.apache.geode.cache.CacheFactory.create(CacheFactory.java:142)}}
> {{ at org.springframework.data.gemfire.CacheFactoryBean.createCache(CacheFactoryBean.java:472)}}
> {{ at org.springframework.data.gemfire.CacheFactoryBean.resolveCache(CacheFactoryBean.java:326)}}
> {{ at org.springframework.data.gemfire.CacheFactoryBean.init(CacheFactoryBean.java:270)}}
> {{ at java.base/java.util.Optional.orElseGet(Optional.java:369)}}
> {{ at org.springframework.data.gemfire.CacheFactoryBean.getObject(CacheFactoryBean.java:802)}}
> {{ at org.springframework.data.gemfire.CacheFactoryBean.getObject(CacheFactoryBean.java:110)}}
> {{ at org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:169)}}
> {{ ... 38 common frames omitted}}
> {{Caused by: java.lang.IllegalStateException: JGAddress.create() returned the wrong class: UUID}}{{ at org.jgroups.conf.ClassConfigurator.add(ClassConfigurator.java:101)}}
> {{ at org.apache.geode.distributed.internal.membership.gms.messenger.JGroupsMessenger.<clinit>(JGroupsMessenger.java:164)}}
> {{ ... 61 common frames omitted}}
--
This message was sent by Atlassian Jira
(v8.20.1#820001)