X-Git-Url: https://gerrit.onap.org/r/gitweb?a=blobdiff_plain;f=docs%2Frelease-notes.rst;h=5e56c6e7a9f242b003ebb2a56b17360fe094d4b4;hb=829c1b2c472f491b108afd6348bd39d570eb0b83;hp=f4ea951a8b1f5a3fab4ecc99e18c56cf3f438364;hpb=88e912e5cc371f5fe37f6a7d6d609de8ca538232;p=sdnc%2Foam.git

diff --git a/docs/release-notes.rst b/docs/release-notes.rst
index f4ea951a..5e56c6e7 100644
--- a/docs/release-notes.rst
+++ b/docs/release-notes.rst
@@ -3,10 +3,11 @@
 Release Notes
 =============
 
-Version 1.5.3
+Version 1.5.4
 -------------
 :Release Date: 2019-06-13
 
+
 **New Features**
 
 The full list of Dublin epics and user stories for SDNC maybe be found at <https://jira.onap.org/issues/?filter=11803>.
@@ -36,12 +37,35 @@ The full list of bug fixes in the SDNC Dublin release may be found at <https://j
 **Known Issues**
 The full list of known issues in SDNC may be found in the ONAP Jira at <https://jira.onap.org/issues/?filter=11119>
 
+One item of note is that the SDNC admin portal was determined to have a number of security vulnerabilities,
+under Known Security Issues.  As a temporary remediation, the admin portal is disabled in
+Dublin.  It will be re-enabled in El Alto once the security issues are addressed.
+
 **Security Notes**
 
 *Fixed Security Issues*
 
+- CVE-2019-12132 `OJSI-41 <https://jira.onap.org/browse/OJSI-41>`_ SDNC service allows for arbitrary code execution in sla/dgUpload form
+  Fixed temporarily by disabling admportal
+- CVE-2019-12123 `OJSI-42 <https://jira.onap.org/browse/OJSI-42>`_ SDNC service allows for arbitrary code execution in sla/printAsXml form
+  Fixed temporarily by disabling admportal
+- CVE-2019-12113 `OJSI-43 <https://jira.onap.org/browse/OJSI-43>`_ SDNC service allows for arbitrary code execution in sla/printAsGv form
+  Fixed temporarily by disabling admportal
+- `OJSI-91 <https://jira.onap.org/browse/OJSI-91>`_ SDNC exposes unprotected API for user creation
+  Fixed temporarily by disabling admportal
+- `OJSI-98 <https://jira.onap.org/browse/OJSI-98>`_ In default deployment SDNC (sdnc-portal) exposes HTTP port 30201 outside of cluster.
+  Fixed temporarily by disabling admportal
+- CVE-2019-12112 `OJSI-199 <https://jira.onap.org/browse/OJSI-199>`_ SDNC service allows for arbitrary code execution in sla/upload form
+  Fixed temporarily by disabling admportal
+
 *Known Security Issues*
 
+- `OJSI-34 <https://jira.onap.org/browse/OJSI-34>`_ Multiple SQL Injection issues in SDNC
+- `OJSI-99 <https://jira.onap.org/browse/OJSI-99>`_ In default deployment SDNC (sdnc) exposes HTTP port 30202 outside of cluster.
+- `OJSI-100 <https://jira.onap.org/browse/OJSI-100>`_ In default deployment SDNC (sdnc-dgbuilder) exposes HTTP port 30203 outside of cluster.
+- `OJSI-179 <https://jira.onap.org/browse/OJSI-179>`_ dev-sdnc-sdnc exposes JDWP on port 1830 which allows for arbitrary code execution
+- `OJSI-183 <https://jira.onap.org/browse/OJSI-183>`_ SDNC exposes ssh service on port 30208
+
 *Known Vulnerabilities in Used Modules*
 
 Quick Links:
@@ -240,5 +264,3 @@ in release 1.2.1:
 
 **Other**
 	NA
-
-