X-Git-Url: https://gerrit.onap.org/r/gitweb?a=blobdiff_plain;f=docs%2Frelease-notes.rst;h=7aae5be007f725ee5d7b24ad8f46ccff8cc5893b;hb=2b1b8b28022a6ff53842c8ca513c5922f0c958a0;hp=9bfac3005b28362e419db527736944e7ce9c5875;hpb=bf19b18511c382add95d33526e0706b7858f276f;p=sdnc%2Foam.git diff --git a/docs/release-notes.rst b/docs/release-notes.rst index 9bfac300..7aae5be0 100644 --- a/docs/release-notes.rst +++ b/docs/release-notes.rst @@ -90,20 +90,32 @@ Dublin. These issues have been resolved in El Alto. *Fixed Security Issues* - CVE-2019-12132 `OJSI-41 `_ SDNC service allows for arbitrary code execution in sla/dgUpload form + Fixed temporarily by disabling admportal. - CVE-2019-12123 `OJSI-42 `_ SDNC service allows for arbitrary code execution in sla/printAsXml form + Fixed temporarily by disabling admportal. - CVE-2019-12113 `OJSI-43 `_ SDNC service allows for arbitrary code execution in sla/printAsGv form + Fixed by removing this API endpoint. - `OJSI-91 `_ SDNC exposes unprotected API for user creation + Fixed temporarily by disabling admportal. - `OJSI-98 `_ In default deployment SDNC (sdnc-portal) exposes HTTP port 30201 outside of cluster. + Port 30201 now uses HTTPS protocol. - CVE-2019-12112 `OJSI-199 `_ SDNC service allows for arbitrary code execution in sla/upload form + Fixed temporarily by disabling admportal. - `OJSI-34 `_ Multiple SQL Injection issues in SDNC - `OJSI-99 `_ In default deployment SDNC (sdnc) exposes HTTP port 30202 outside of cluster. + Port 30202 is no longer used. - `OJSI-100 `_ In default deployment SDNC (sdnc-dgbuilder) exposes HTTP port 30203 outside of cluster. + Port 30203 now uses HTTPS protocol. - `OJSI-179 `_ dev-sdnc-sdnc exposes JDWP on port 1830 which allows for arbitrary code execution + Ticket has been closed as no one was able to reproduce the issue. - `OJSI-183 `_ SDNC exposes ssh service on port 30208 + Port 30202 is no longer used. *Known Security Issues* - +For CVE-2019-12132, CVE-2019-12123 and CVE-2019-12112 only temporary fix has been applied. +This fix simply prevents admportal from being started and exposed. +If admportal is to be used in your deployment, please be very cautious and remember to fix those vulnerabilities on your own. *Known Vulnerabilities in Used Modules*