Security Vulnerabilities

Issue-ID: PORTAL-155

Includes Security Vulnerabilities and music jar

Change-Id: Id85471555461adf2127db66ed3d4f4a3d5a06fe4
Signed-off-by: Lo, WEI-TING(wl849v) <wl849v@att.com>

diff --git a/ecomp-sdk/epsdk-app-common/pom.xml b/ecomp-sdk/epsdk-app-common/pom.xml
index e9eec2a..6e4f9e1 100644 (file)
--- a/ecomp-sdk/epsdk-app-common/pom.xml
+++ b/ecomp-sdk/epsdk-app-common/pom.xml
@@ -172,6 +172,12 @@
                        <groupId>org.elasticsearch</groupId>
                        <artifactId>elasticsearch</artifactId>
                        <version>2.2.0</version>
+                       <exclusions> 
+                               <exclusion> 
+                                       <groupId>org.apache.lucene</groupId> 
+                                       <artifactId>lucene-queryparser</artifactId> 
+                               </exclusion> 
+                       </exclusions>
                </dependency>
                <dependency>
                        <groupId>org.json</groupId>
@@ -245,6 +251,14 @@
                <groupId>commons-httpclient</groupId>
             <artifactId>commons-httpclient</artifactId>
                </exclusion>
+               <exclusion> 
+               <groupId>xerces</groupId> 
+            <artifactId>xercesImpl</artifactId> 
+               </exclusion> 
+        <exclusion> 
+               <groupId>commons-collections</groupId> 
+            <artifactId>commons-collections</artifactId> 
+               </exclusion>
         </exclusions>
        </dependency>
        <!-- Jacoco for offline instrumentation -->
@@ -254,11 +268,7 @@
                        <version>${jacoco.version}</version>
                        <classifier>runtime</classifier>
                </dependency>
-               <dependency>
-               <groupId>org.apache.lucene</groupId>
-               <artifactId>lucene-queryparser</artifactId>
-               <version>7.2.1</version>
-               </dependency>
+
                <dependency>
                <groupId>com.thoughtworks.xstream</groupId>
                <artifactId>xstream</artifactId>
@@ -287,68 +297,9 @@
                <dependency>
                <groupId>commons-beanutils</groupId>
                <artifactId>commons-beanutils</artifactId>
-               <version>1.9.2</version>
-               </dependency>
-               <dependency>
-                       <groupId>org.apache.poi</groupId>
-                       <artifactId>poi</artifactId>
-                       <version>3.17</version>
-                       <exclusions>
-                               <exclusion>
-                                       <groupId>commons-logging</groupId>
-                                       <artifactId>commons-logging</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>log4j</groupId>
-                                       <artifactId>log4j</artifactId>
-                               </exclusion>
-                       </exclusions>
-               </dependency>
-               <dependency>
-                       <groupId>org.apache.poi</groupId>
-                       <artifactId>poi-ooxml</artifactId>
-                       <version>3.17</version>
-                       <exclusions>
-                               <exclusion>
-                                       <groupId>commons-logging</groupId>
-                                       <artifactId>commons-logging</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>log4j</groupId>
-                                       <artifactId>log4j</artifactId>
-                               </exclusion>
-                       </exclusions>
-               </dependency>
-               <dependency>
-                       <groupId>org.apache.poi</groupId>
-                       <artifactId>poi-scratchpad</artifactId>
-                       <version>3.17</version>
-                       <exclusions>
-                               <exclusion>
-                                       <groupId>commons-logging</groupId>
-                                       <artifactId>commons-logging</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>log4j</groupId>
-                                       <artifactId>log4j</artifactId>
-                               </exclusion>
-                       </exclusions>
-               </dependency>
-               <dependency>
-                       <groupId>org.apache.poi</groupId>
-                       <artifactId>poi-contrib</artifactId>
-                       <version>3.5-FINAL</version>
-                       <exclusions>
-                               <exclusion>
-                                       <groupId>commons-logging</groupId>
-                                       <artifactId>commons-logging</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>log4j</groupId>
-                                       <artifactId>log4j</artifactId>
-                               </exclusion>
-                       </exclusions>
+               <version>1.9.3</version>
                </dependency>
+               
                <dependency>
                        <groupId>org.apache.httpcomponents</groupId>
                        <artifactId>httpclient</artifactId>
@@ -359,5 +310,15 @@
                <artifactId>xalan</artifactId>
                <version>2.7.2</version>
                </dependency>   
+               <dependency> 
+               <groupId>xerces</groupId> 
+               <artifactId>xercesImpl</artifactId> 
+               <version>2.11.0.SP5</version> 
+               </dependency> 
+               <dependency> 
+               <groupId>commons-collections</groupId> 
+               <artifactId>commons-collections</artifactId> 
+               <version>3.2.2</version> 
+               </dependency>
        </dependencies>
 </project>

diff --git a/ecomp-sdk/epsdk-app-os/pom.xml b/ecomp-sdk/epsdk-app-os/pom.xml
index 7bcaec6..ff5ce26 100644 (file)
--- a/ecomp-sdk/epsdk-app-os/pom.xml
+++ b/ecomp-sdk/epsdk-app-os/pom.xml
@@ -307,6 +307,12 @@
                        <groupId>org.elasticsearch</groupId>
                        <artifactId>elasticsearch</artifactId>
                        <version>2.2.0</version>
+                       <exclusions> 
+                               <exclusion> 
+                                       <groupId>org.apache.lucene</groupId> 
+                                       <artifactId>lucene-queryparser</artifactId> 
+                               </exclusion> 
+                       </exclusions>
                </dependency>
                <dependency>
                        <groupId>org.json</groupId>

diff --git a/ecomp-sdk/epsdk-core/pom.xml b/ecomp-sdk/epsdk-core/pom.xml
index abaad56..8fd5a6e 100644 (file)
--- a/ecomp-sdk/epsdk-core/pom.xml
+++ b/ecomp-sdk/epsdk-core/pom.xml
@@ -319,6 +319,12 @@
                        <groupId>org.elasticsearch</groupId>
                        <artifactId>elasticsearch</artifactId>
                        <version>2.2.0</version>
+                       <exclusions> 
+                               <exclusion> 
+                                       <groupId>org.apache.lucene</groupId> 
+                                       <artifactId>lucene-queryparser</artifactId> 
+                               </exclusion> 
+                       </exclusions>
                </dependency>
                <dependency>
                        <groupId>io.searchbox</groupId>
@@ -351,6 +357,10 @@
                <groupId>commons-httpclient</groupId>
             <artifactId>commons-httpclient</artifactId>
                </exclusion>
+               <exclusion> 
+               <groupId>xerces</groupId> 
+            <artifactId>xercesImpl</artifactId> 
+               </exclusion>
         </exclusions>
        </dependency>
 
@@ -386,11 +396,6 @@
                        <classifier>runtime</classifier>
                </dependency>
                <dependency>
-               <groupId>org.apache.lucene</groupId>
-               <artifactId>lucene-queryparser</artifactId>
-               <version>7.2.1</version>
-               </dependency>
-               <dependency>
                <groupId>com.thoughtworks.xstream</groupId>
                <artifactId>xstream</artifactId>
                <version>1.4.10</version>
@@ -418,67 +423,7 @@
                <dependency>
                <groupId>commons-beanutils</groupId>
                <artifactId>commons-beanutils</artifactId>
-               <version>1.9.2</version>
-               </dependency>
-               <dependency>
-                       <groupId>org.apache.poi</groupId>
-                       <artifactId>poi</artifactId>
-                       <version>3.17</version>
-                       <exclusions>
-                               <exclusion>
-                                       <groupId>commons-logging</groupId>
-                                       <artifactId>commons-logging</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>log4j</groupId>
-                                       <artifactId>log4j</artifactId>
-                               </exclusion>
-                       </exclusions>
-               </dependency>
-               <dependency>
-                       <groupId>org.apache.poi</groupId>
-                       <artifactId>poi-ooxml</artifactId>
-                       <version>3.17</version>
-                       <exclusions>
-                               <exclusion>
-                                       <groupId>commons-logging</groupId>
-                                       <artifactId>commons-logging</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>log4j</groupId>
-                                       <artifactId>log4j</artifactId>
-                               </exclusion>
-                       </exclusions>
-               </dependency>
-               <dependency>
-                       <groupId>org.apache.poi</groupId>
-                       <artifactId>poi-scratchpad</artifactId>
-                       <version>3.17</version>
-                       <exclusions>
-                               <exclusion>
-                                       <groupId>commons-logging</groupId>
-                                       <artifactId>commons-logging</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>log4j</groupId>
-                                       <artifactId>log4j</artifactId>
-                               </exclusion>
-                       </exclusions>
-               </dependency>
-               <dependency>
-                       <groupId>org.apache.poi</groupId>
-                       <artifactId>poi-contrib</artifactId>
-                       <version>3.5-FINAL</version>
-                       <exclusions>
-                               <exclusion>
-                                       <groupId>commons-logging</groupId>
-                                       <artifactId>commons-logging</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>log4j</groupId>
-                                       <artifactId>log4j</artifactId>
-                               </exclusion>
-                       </exclusions>
+               <version>1.9.3</version>
                </dependency>
                <dependency>
                        <groupId>org.apache.httpcomponents</groupId>
@@ -489,7 +434,12 @@
                <groupId>xalan</groupId>
                <artifactId>xalan</artifactId>
                <version>2.7.2</version>
-               </dependency>           
+               </dependency>   
+               <dependency> 
+               <groupId>xerces</groupId> 
+               <artifactId>xercesImpl</artifactId> 
+               <version>2.11.0.SP5</version> 
+               </dependency>   
        </dependencies>
        
 </project>

diff --git a/ecomp-sdk/epsdk-fw/pom.xml b/ecomp-sdk/epsdk-fw/pom.xml
index 0cecde9..6260084 100644 (file)
--- a/ecomp-sdk/epsdk-fw/pom.xml
+++ b/ecomp-sdk/epsdk-fw/pom.xml
@@ -91,6 +91,22 @@
                                        <groupId>log4j</groupId>
                                        <artifactId>log4j</artifactId>
                                </exclusion>
+                               <exclusion>
+                                       <groupId>xerces</groupId>
+                                       <artifactId>xercesImpl</artifactId>
+                               </exclusion>
+                               <exclusion>
+                                       <groupId>xalan</groupId>
+                                       <artifactId>xalan</artifactId>
+                               </exclusion>
+                               <exclusion>
+                                       <groupId>commons-beanutils</groupId>
+                                       <artifactId>commons-beanutils-core</artifactId>
+                               </exclusion>
+                               <exclusion>
+                                       <groupId>commons-httpclient</groupId>
+                                       <artifactId>commons-httpclient</artifactId>
+                               </exclusion>
                        </exclusions>
                </dependency>
                <dependency>
@@ -98,6 +114,12 @@
                        <artifactId>junit</artifactId>
                        <version>4.12</version>
                        <scope>test</scope>
+                       <exclusions> 
+                               <exclusion> 
+                                       <groupId>org.apache.httpcomponents</groupId> 
+                                       <artifactId>httpclient</artifactId> 
+                               </exclusion> 
+                       </exclusions>
                </dependency>
                <!-- Test scaffold -->
                <dependency>
@@ -148,18 +170,18 @@
                        <version>1.0.0.Final</version>
                        <scope>test</scope>
                </dependency>
-        <dependency>
-            <groupId>org.mockito</groupId>
-            <artifactId>mockito-core</artifactId>
-            <version>1.10.19</version>
-            <scope>test</scope>
-        </dependency>
                <dependency>
-                   <groupId>org.jacoco</groupId>
-                   <artifactId>org.jacoco.agent</artifactId>
-                   <classifier>runtime</classifier>
-                   <scope>test</scope>
-                   <version>${jacoco.version}</version>
+                       <groupId>org.mockito</groupId>
+                       <artifactId>mockito-core</artifactId>
+                       <version>1.10.19</version>
+                       <scope>test</scope>
+               </dependency>
+               <dependency>
+                       <groupId>org.jacoco</groupId>
+                       <artifactId>org.jacoco.agent</artifactId>
+                       <classifier>runtime</classifier>
+                       <scope>test</scope>
+                       <version>${jacoco.version}</version>
                </dependency>
                <dependency>
                        <groupId>commons-fileupload</groupId>
@@ -167,9 +189,9 @@
                        <version>1.3.3</version>
                </dependency>
                <dependency>
-               <groupId>commons-beanutils</groupId>
-               <artifactId>commons-beanutils</artifactId>
-               <version>1.9.2</version>
+                       <groupId>commons-beanutils</groupId>
+                       <artifactId>commons-beanutils</artifactId>
+                       <version>1.9.3</version>
                </dependency>
        </dependencies>
 

diff --git a/ecomp-sdk/epsdk-music/dependencies/org/onap/music/core/2.4.4.1/core-2.4.4.1.jar b/ecomp-sdk/epsdk-music/dependencies/org/onap/music/core/2.4.4.1/core-2.4.4.1.jar
new file mode 100644 (file)
index 0000000..c87ed1c
Binary files /dev/null and b/ecomp-sdk/epsdk-music/dependencies/org/onap/music/core/2.4.4.1/core-2.4.4.1.jar differ

diff --git a/ecomp-sdk/epsdk-music/dependencies/org/onap/music/core/2.4.4/core-2.4.4.jar b/ecomp-sdk/epsdk-music/dependencies/org/onap/music/core/2.4.4/core-2.4.4.jar
deleted file mode 100644 (file)
index c2dd2db..0000000
Binary files a/ecomp-sdk/epsdk-music/dependencies/org/onap/music/core/2.4.4/core-2.4.4.jar and /dev/null differ

diff --git a/ecomp-sdk/epsdk-music/dependencies/org/onap/music/core/maven-metadata-local.xml b/ecomp-sdk/epsdk-music/dependencies/org/onap/music/core/maven-metadata-local.xml
index 01c2b2b..9e95356 100644 (file)
--- a/ecomp-sdk/epsdk-music/dependencies/org/onap/music/core/maven-metadata-local.xml
+++ b/ecomp-sdk/epsdk-music/dependencies/org/onap/music/core/maven-metadata-local.xml
@@ -3,10 +3,10 @@
   <groupId>org.onap.music</groupId>
   <artifactId>core</artifactId>
   <versioning>
-    <release>2.4.4</release>
+    <release>2.4.4.1</release>
     <versions>
-      <version>2.4.4</version>
+      <version>2.4.4.1</version>
     </versions>
-    <lastUpdated>20180302203455</lastUpdated>
+    <lastUpdated>20180302703455</lastUpdated>
   </versioning>
 </metadata>

diff --git a/ecomp-sdk/epsdk-music/pom.xml b/ecomp-sdk/epsdk-music/pom.xml
index 3b18817..2c2a7e1 100644 (file)
--- a/ecomp-sdk/epsdk-music/pom.xml
+++ b/ecomp-sdk/epsdk-music/pom.xml
@@ -7,7 +7,7 @@
                <artifactId>epsdk-project</artifactId>
                <version>2.2.0-SNAPSHOT</version>
        </parent>
-       
+
        <groupId>org.onap.portal.sdk</groupId>
        <artifactId>epsdk-music</artifactId>
        <version>2.2.0-SNAPSHOT</version>
@@ -18,7 +18,7 @@
 
        <properties>
                <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-               <springframework.version>4.2.0.RELEASE</springframework.version>
+               <springframework.version>4.2.3.RELEASE</springframework.version>
                <jersey1.version>1.19.4</jersey1.version>
                <jaxrs.version>2.0.1</jaxrs.version>
                <cassandra.version>3.0.0</cassandra.version>
@@ -108,35 +108,45 @@
                        <groupId>com.att.eelf</groupId>
                        <artifactId>eelf-core</artifactId>
                        <version>1.0.0</version>
+                       <exclusions>
+                               <exclusion>
+                                       <groupId>ch.qos.logback</groupId>
+                                       <artifactId>logback-classic</artifactId>
+                               </exclusion>
+                               <exclusion>
+                                       <groupId>ch.qos.logback</groupId>
+                                       <artifactId>logback-core</artifactId>
+                               </exclusion>
+                       </exclusions>
                </dependency>
 
                <!-- Music -->
                <dependency>
                        <groupId>org.onap.music</groupId>
                        <artifactId>core</artifactId>
-                       <version>2.4.4</version>
-               </dependency>  
-               <dependency>
+                       <version>2.4.4.1</version>
+               </dependency>
+               <!-- <dependency>
                        <groupId>org.onap.music</groupId>
                        <artifactId>dependency</artifactId>
                        <version>2.4.4</version>
-               </dependency>  
+               </dependency> -->
 
                <!-- Mapper -->
                <dependency>
                        <groupId>com.fasterxml.jackson.core</groupId>
                        <artifactId>jackson-annotations</artifactId>
-                       <version>2.6.3</version>
+                       <version>2.8.10</version>
                </dependency>
                <dependency>
                        <groupId>com.fasterxml.jackson.core</groupId>
                        <artifactId>jackson-core</artifactId>
-                       <version>2.6.3</version>
+                       <version>2.8.10</version>
                </dependency>
                <dependency>
                        <groupId>com.fasterxml.jackson.core</groupId>
                        <artifactId>jackson-databind</artifactId>
-                       <version>2.6.3</version>
+                       <version>2.8.10</version>
                </dependency>
                <dependency>
                        <groupId>org.springframework.session</groupId>
@@ -148,6 +158,16 @@
                        <artifactId>json</artifactId>
                        <version>20160212</version>
                </dependency>
+               <dependency>
+                       <groupId>ch.qos.logback</groupId>
+                       <artifactId>logback-core</artifactId>
+                       <version>1.2.3</version>
+               </dependency>
+               <dependency>
+                       <groupId>ch.qos.logback</groupId>
+                       <artifactId>logback-classic</artifactId>
+                       <version>1.2.3</version>
+               </dependency>
        </dependencies>
        <profiles>
                <!-- disable doclint, a new feature in Java 8, when generating javadoc -->
@@ -186,26 +206,26 @@
                                </configuration>
                        </plugin>
                        <plugin>
-                       <artifactId>maven-assembly-plugin</artifactId>
-                       <configuration>
-                               <archive>
-                                       <manifest>
-                                       </manifest>
-                               </archive>
-                               <descriptorRefs>
-                                       <descriptorRef>jar-with-dependencies</descriptorRef>
-                               </descriptorRefs>
-                       </configuration>
-                       <executions>
-                               <execution>
-                                       <id>make-assembly</id> <!-- this is used for inheritance merges -->
-                                       <phase>package</phase> <!-- bind to the packaging phase -->
-                                       <goals>
-                                               <goal>single</goal>
-                                       </goals>
-                               </execution>
-                       </executions>
-               </plugin>
+                               <artifactId>maven-assembly-plugin</artifactId>
+                               <configuration>
+                                       <archive>
+                                               <manifest>
+                                               </manifest>
+                                       </archive>
+                                       <descriptorRefs>
+                                               <descriptorRef>jar-with-dependencies</descriptorRef>
+                                       </descriptorRefs>
+                               </configuration>
+                               <executions>
+                                       <execution>
+                                               <id>make-assembly</id> <!-- this is used for inheritance merges -->
+                                               <phase>package</phase> <!-- bind to the packaging phase -->
+                                               <goals>
+                                                       <goal>single</goal>
+                                               </goals>
+                                       </execution>
+                               </executions>
+                       </plugin>
                </plugins>
        </build>
 </project>

diff --git a/ecomp-sdk/pom.xml b/ecomp-sdk/pom.xml
index 8ae5633..e3db8a9 100644 (file)
--- a/ecomp-sdk/pom.xml
+++ b/ecomp-sdk/pom.xml
@@ -32,7 +32,7 @@
 
        <properties>
                <encoding>UTF-8</encoding>
-               <springframework.version>4.2.2.RELEASE</springframework.version>
+               <springframework.version>4.2.3.RELEASE</springframework.version>
                <hibernate.version>4.3.11.Final</hibernate.version>
                <skiptests>false</skiptests>
                <nexusproxy>https://nexus.onap.org</nexusproxy>