Fix vulnerability issue in resmgr

upgrade springframework from 3.x to 4.x

CVE-2016-6812
CVE-2018-1270
CVE-2018-11039
SONATYPE-2015-0002
CVE-2014-3578
CVE-2018-1257
CVE-2017-12624
CVE-2018-8039

Change-Id: I59014c277df9bf201bb672a108a82a2deb0ed95b
Issue-ID: VFC-1187
Signed-off-by: Victor Gao <victor.gao@huawei.com>
(cherry picked from commit ea18924cd5505f5e36ea58e7424db54c41db4605)

diff --git a/ResmanagementService/service/pom.xml b/ResmanagementService/service/pom.xml
index 3e043b7..7571b8f 100644 (file)
--- a/ResmanagementService/service/pom.xml
+++ b/ResmanagementService/service/pom.xml
@@ -104,7 +104,7 @@
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-tx</artifactId>
-            <version>3.1.0.RELEASE</version>
+            <version>3.1.2.RELEASE</version>
         </dependency>
         <dependency>
             <groupId>org.mybatis</groupId>
@@ -151,53 +151,64 @@
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-core</artifactId>
-            <version>3.1.0.RELEASE</version>
+            <version>4.3.18.RELEASE</version>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-aop</artifactId>
-            <version>3.1.0.RELEASE</version>
+            <version>4.3.18.RELEASE</version>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-beans</artifactId>
-            <version>3.1.0.RELEASE</version>
+            <version>4.3.18.RELEASE</version>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-context</artifactId>
-            <version>3.1.0.RELEASE</version>
+            <version>4.3.18.RELEASE</version>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-jdbc</artifactId>
-            <version>3.1.0.RELEASE</version>
+            <version>4.3.18.RELEASE</version>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-web</artifactId>
             <version>3.2.14.RELEASE</version>
         </dependency>
-        <dependency>
+        <!--dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-asm</artifactId>
-            <version>3.1.0.RELEASE</version>
-        </dependency>
+            <version>4.3.18.RELEASE</version>
+        </dependency-->
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-expression</artifactId>
-            <version>3.1.0.RELEASE</version>
+            <version>4.3.18.RELEASE</version>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-test</artifactId>
-            <version>3.1.0.RELEASE</version>
+            <version>4.3.18.RELEASE</version>
         </dependency>
 
+        <dependency>
+            <groupId>org.apache.cxf</groupId>
+            <artifactId>cxf-rt-transports-http</artifactId>
+            <version>3.1.17</version>
+        </dependency>
         <dependency>
             <groupId>org.apache.cxf</groupId>
             <artifactId>cxf-rt-frontend-jaxrs</artifactId>
-            <version>3.1.6</version>
+            <version>3.1.17</version>
+                       <exclusions>
+                <exclusion>
+                    <groupId>org.apache.cxf</groupId>
+                    <artifactId>cxf-rt-transports-http</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <!-- UT coverage dependency start -->
         <dependency>

diff --git a/ResmanagementService/service/src/main/java/org/onap/vfc/nfvo/resmanagement/service/activator/ROAResmgrServicePostProcessor.java b/ResmanagementService/service/src/main/java/org/onap/vfc/nfvo/resmanagement/service/activator/ROAResmgrServicePostProcessor.java
deleted file mode 100644 (file)
index 300ee7d..0000000
--- a/ResmanagementService/service/src/main/java/org/onap/vfc/nfvo/resmanagement/service/activator/ROAResmgrServicePostProcessor.java
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * Copyright 2016 Huawei Technologies Co., Ltd.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.onap.vfc.nfvo.resmanagement.service.activator;
-
-import org.onap.vfc.nfvo.resmanagement.service.adapter.inf.IResmgrAdapterMgrService;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.BeansException;
-import org.springframework.beans.factory.config.DestructionAwareBeanPostProcessor;
-
-/**
- * <br>
- * <p>
- * </p>
- * 
- * @author
- * @version VFC 1.0 Sep 22, 2016
- */
-public class ROAResmgrServicePostProcessor implements DestructionAwareBeanPostProcessor {
-
-    private static final Logger LOG = LoggerFactory.getLogger(ROAResmgrServicePostProcessor.class);
-
-    @Override
-    public Object postProcessAfterInitialization(Object bean, String name) throws BeansException {
-        if(bean instanceof IResmgrAdapterMgrService) {
-            LOG.warn("Register to Microservice BUS!");
-            IResmgrAdapterMgrService resmgrAdapterSvc = (IResmgrAdapterMgrService)bean;
-            resmgrAdapterSvc.register();
-        }
-
-        return bean;
-    }
-
-    @Override
-    public Object postProcessBeforeInitialization(Object bean, String name) throws BeansException {
-        LOG.info("postProcessBeforeInitialization");
-        return bean;
-    }
-
-    @Override
-    public void postProcessBeforeDestruction(Object bean, String name) throws BeansException {
-        LOG.info("postProcessBeforeDestruction");
-    }
-
-}

diff --git a/ResmanagementService/service/src/main/resources/spring/Resmanagement/services.xml b/ResmanagementService/service/src/main/resources/spring/Resmanagement/services.xml
index e60bf19..db1eccb 100644 (file)
--- a/ResmanagementService/service/src/main/resources/spring/Resmanagement/services.xml
+++ b/ResmanagementService/service/src/main/resources/spring/Resmanagement/services.xml
@@ -35,7 +35,7 @@
     http://cxf.apache.org/transports/http/configuration
     http://cxf.apache.org/schemas/configuration/http-conf.xsd
     http://www.springframework.org/schema/aop
-    http://www.springframework.org/schema/aop/spring-aop-3.0.xsd">
+    http://www.springframework.org/schema/aop/spring-aop.xsd">
 
     <!-- these are included in the dependency jar -->
     <import resource="classpath:META-INF/cxf/cxf.xml" />

diff --git a/ResmanagementService/service/src/main/resources/spring/Resmanagement/svc_register.xml b/ResmanagementService/service/src/main/resources/spring/Resmanagement/svc_register.xml
index 1306e39..e17d2d2 100644 (file)
--- a/ResmanagementService/service/src/main/resources/spring/Resmanagement/svc_register.xml
+++ b/ResmanagementService/service/src/main/resources/spring/Resmanagement/svc_register.xml
@@ -36,7 +36,7 @@
     http://cxf.apache.org/schemas/configuration/http-conf.xsd
     http://www.springframework.org/schema/aop
     http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd 
-    http://www.springframework.org/schema/aop/spring-aop-3.0.xsd">
+    http://www.springframework.org/schema/aop/spring-aop.xsd">
     <!-- 
     <bean class="org.onap.vfc.nfvo.resmanagement.service.activator.ROAResmgrServicePostProcessor"></bean>
     <bean class="org.onap.vfc.nfvo.resmanagement.service.adapter.impl.ResmgrAdapterMgrService"></bean>