Remove logback 1.1.3 security issue 99/67099/2
authorPatrick Brady <pb071s@att.com>
Mon, 17 Sep 2018 19:52:55 +0000 (12:52 -0700)
committerPatrick Brady <pb071s@att.com>
Fri, 21 Sep 2018 16:31:27 +0000 (09:31 -0700)
cdp-pal and eelf are the dependencies using logback-classic
1.1.3. Need to use exclusions option in pom file

Change-Id: Id8f5817ec955e2b7b486bc0215c35541086606aa
Signed-off-by: Patrick Brady <pb071s@att.com>
Issue-ID: APPC-1018

21 files changed:
appc-adapters/appc-chef-adapter/appc-chef-adapter-bundle/pom.xml
appc-adapters/appc-iaas-adapter/appc-iaas-adapter-bundle/pom.xml
appc-adapters/appc-netconf-adapter/appc-netconf-adapter-bundle/pom.xml
appc-adapters/appc-rest-adapter/appc-rest-adapter-bundle/pom.xml
appc-adapters/appc-rest-healthcheck-adapter/appc-rest-healthcheck-adapter-bundle/pom.xml
appc-adapters/appc-ssh-adapter/appc-ssh-adapter-sshd/pom.xml
appc-config/appc-config-adaptor/provider/pom.xml
appc-config/appc-config-audit/provider/pom.xml
appc-config/appc-config-generator/provider/pom.xml
appc-config/appc-data-services/provider/pom.xml
appc-config/appc-encryption-tool/provider/pom.xml
appc-config/appc-flow-controller/provider/pom.xml
appc-core/appc-common-bundle/pom.xml
appc-event-listener/appc-event-listener-bundle/pom.xml
appc-inbound/appc-design-services/provider/pom.xml
appc-inbound/appc-interfaces-service/bundle/pom.xml
appc-lifecycle-management/appc-lifecycle-management-core/pom.xml
appc-outbound/appc-aai-client/provider/pom.xml
appc-outbound/appc-network-inventory-client/provider/pom.xml
appc-parent/binding-parent/pom.xml
pom.xml

index 417c70d..105cf47 100644 (file)
         <dependency>
             <groupId>com.att.cdp</groupId>
             <artifactId>cdp-pal-common</artifactId>
-            <scope>compile</scope>
             <version>${cdp.pal.version}</version>
+            <scope>compile</scope>
+            <exclusions>
+                <exclusion>
+                  <groupId>ch.qos.logback</groupId>
+                  <artifactId>logback-classic</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
             <artifactId>cdp-pal-openstack</artifactId>
             <scope>compile</scope>
             <version>${cdp.pal.version}</version>
+            <exclusions>
+                  <exclusion>
+                       <groupId>com.att.cdp</groupId>
+                       <artifactId>cdp-pal-common</artifactId>
+                  </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
index 331773f..91cdd26 100644 (file)
             </exclusions>
         </dependency>
 
+
+        <dependency>
+            <groupId>com.att.cdp</groupId>
+            <artifactId>cdp-pal-common</artifactId>
+            <scope>compile</scope>
+            <version>${cdp.pal.version}</version>
+            <exclusions>
+                <exclusion>
+                  <groupId>ch.qos.logback</groupId>
+                  <artifactId>logback-classic</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+
         <dependency>
             <groupId>com.att.cdp</groupId>
             <artifactId>cdp-pal-openstack</artifactId>
             <scope>compile</scope>
             <version>${cdp.pal.version}</version>
+            <exclusions>
+                  <exclusion>
+                       <groupId>com.att.cdp</groupId>
+                       <artifactId>cdp-pal-common</artifactId>
+                  </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
index f87d7d1..a61659c 100644 (file)
             <artifactId>cdp-pal-common</artifactId>
             <scope>compile</scope>
             <version>${cdp.pal.version}</version>
+            <exclusions>
+                <exclusion>
+                  <groupId>ch.qos.logback</groupId>
+                  <artifactId>logback-classic</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
             <artifactId>cdp-pal-openstack</artifactId>
             <scope>compile</scope>
             <version>${cdp.pal.version}</version>
+            <exclusions>
+                  <exclusion>
+                       <groupId>com.att.cdp</groupId>
+                       <artifactId>cdp-pal-common</artifactId>
+                  </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
index b67b3bd..8c666b6 100644 (file)
                        <artifactId>cdp-pal-common</artifactId>
                        <scope>compile</scope>
                         <version>${cdp.pal.version}</version>
+                        <exclusions>
+                            <exclusion>
+                                 <groupId>ch.qos.logback</groupId>
+                                 <artifactId>logback-classic</artifactId>
+                            </exclusion>
+                        </exclusions>
                </dependency>
 
                <dependency>
                        <artifactId>cdp-pal-openstack</artifactId>
                        <scope>compile</scope>
                         <version>${cdp.pal.version}</version>
+                        <exclusions>
+                            <exclusion>
+                                 <groupId>com.att.cdp</groupId>
+                                 <artifactId>cdp-pal-common</artifactId>
+                            </exclusion>
+                        </exclusions>
                </dependency>
 
                <dependency>
index 0e0ce51..5175532 100644 (file)
             <groupId>com.att.cdp</groupId>
             <artifactId>cdp-pal-common</artifactId>
             <scope>compile</scope>
+            <exclusions>
+                <exclusion>
+                  <groupId>ch.qos.logback</groupId>
+                  <artifactId>logback-classic</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
             <groupId>com.att.cdp</groupId>
             <artifactId>cdp-pal-openstack</artifactId>
             <scope>compile</scope>
+            <exclusions>
+                  <exclusion>
+                       <groupId>com.att.cdp</groupId>
+                       <artifactId>cdp-pal-common</artifactId>
+                  </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
index 4d00b57..c658566 100644 (file)
             <scope>provided</scope>
             <version>2.0.0</version>
         </dependency>
+        <dependency>
+         <groupId>ch.qos.logback</groupId>
+         <artifactId>logback-classic</artifactId>
+        <version>${logback.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.att.eelf</groupId>
             <artifactId>eelf-core</artifactId>
+            <exclusions>
+                 <exclusion>
+                      <groupId>ch.qos.logback</groupId>
+                      <artifactId>logback-classic</artifactId>
+                 </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>junit</groupId>
index aa5e24f..4fbf5a5 100644 (file)
                        <artifactId>mockito-core</artifactId>
                        <scope>test</scope>
                </dependency>
-
+        <dependency>
+         <groupId>ch.qos.logback</groupId>
+         <artifactId>logback-classic</artifactId>
+        <version>${logback.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.att.eelf</groupId>
             <artifactId>eelf-core</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>ch.qos.logback</groupId>
+                    <artifactId>logback-classic</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
index 3babf6d..bb66292 100644 (file)
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
         </dependency>
+        <dependency>
+         <groupId>ch.qos.logback</groupId>
+         <artifactId>logback-classic</artifactId>
+        <version>${logback.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.att.eelf</groupId>
             <artifactId>eelf-core</artifactId>
+            <exclusions>
+                <exclusion>
+                     <groupId>ch.qos.logback</groupId>
+                     <artifactId>logback-classic</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.apache.commons</groupId>
index 2718735..fd5eacd 100644 (file)
                 <artifactId>commons-collections</artifactId>
                 <version>3.2.2</version>
           </dependency>
-
+         <dependency>
+           <groupId>ch.qos.logback</groupId>
+           <artifactId>logback-classic</artifactId>
+          <version>${logback.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.att.eelf</groupId>
             <artifactId>eelf-core</artifactId>
+            <exclusions>
+                 <exclusion>
+                      <groupId>ch.qos.logback</groupId>
+                      <artifactId>logback-classic</artifactId>
+                 </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
index 92468db..0b5676e 100644 (file)
                        <groupId>commons-io</groupId>
                        <artifactId>commons-io</artifactId>
                </dependency>
+                <dependency>
+                     <groupId>ch.qos.logback</groupId>
+                     <artifactId>logback-classic</artifactId>
+                    <version>${logback.version}</version>
+                </dependency>
 
                <dependency>
                        <groupId>com.att.eelf</groupId>
                        <artifactId>eelf-core</artifactId>
+                       <exclusions>
+                            <exclusion>
+                                 <groupId>ch.qos.logback</groupId>
+                                 <artifactId>logback-classic</artifactId>
+                            </exclusion>
+                        </exclusions>
                </dependency>
 
                <dependency>
                                                <Bundle-SymbolicName>appc-config-data-services</Bundle-SymbolicName>
                                                <Bundle-Activator>org.onap.appc.data.services.AppcDataServiceActivator</Bundle-Activator>
                                                <Export-Package>org.onap.appc.data.services</Export-Package>
-                                               <Import-Package>*</Import-Package>
+                                               <Import-Package>groovy.lang;resolution:=optional,
+                                                   org.codehaus.groovy.*;resolution:=optional,*</Import-Package>
                                                <Embed-Dependency>eelf-core,logback-core,logback-classic</Embed-Dependency>
                                                <DynamicImport-Package>*</DynamicImport-Package>
                                        </instructions>
index 2866797..d9ffca4 100644 (file)
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
         </dependency>
+        <dependency>
+         <groupId>ch.qos.logback</groupId>
+         <artifactId>logback-classic</artifactId>
+        <version>${logback.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.att.eelf</groupId>
             <artifactId>eelf-core</artifactId>
+            <exclusions>
+                 <exclusion>
+                     <groupId>ch.qos.logback</groupId>
+                     <artifactId>logback-classic</artifactId>
+                 </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>commons-configuration</groupId>
index f3cd09b..065b3be 100644 (file)
             <groupId>com.fasterxml.jackson.dataformat</groupId>
             <artifactId>jackson-dataformat-yaml</artifactId>
         </dependency>
+        <dependency>
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-classic</artifactId>
+           <version>${logback.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.att.eelf</groupId>
             <artifactId>eelf-core</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>ch.qos.logback</groupId>
+                    <artifactId>logback-classic</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.onap.ccsdk.sli.adaptors</groupId>
                         <Bundle-SymbolicName>org.onap.appc.flow.controller</Bundle-SymbolicName>
                         <Bundle-Activator>org.onap.appc.flow.controller.FlowControllerActivator</Bundle-Activator>
                         <Export-Package>org.onap.appc.flow.controller</Export-Package>
-                        <Import-Package>*</Import-Package>
+                        <Import-Package>groovy.lang;resolution:=optional,
+                            org.codehaus.groovy.*;resolution:=optional,*</Import-Package>
                         <Embed-Dependency>eelf-core,logback-core,logback-classic</Embed-Dependency>
                         <DynamicImport-Package>*</DynamicImport-Package>
                     </instructions>
index 0f72a16..07300f5 100644 (file)
   \r
   <dependencies>\r
     <!--  logging  -->\r
+    <dependency>\r
+         <groupId>ch.qos.logback</groupId>\r
+         <artifactId>logback-classic</artifactId>\r
+        <version>${logback.version}</version>\r
+    </dependency>\r
     <dependency>\r
       <groupId>com.att.eelf</groupId>\r
       <artifactId>eelf-core</artifactId>\r
+      <exclusions>\r
+           <exclusion>\r
+               <groupId>ch.qos.logback</groupId>\r
+               <artifactId>logback-classic</artifactId>\r
+           </exclusion>\r
+      </exclusions>\r
     </dependency>\r
     <dependency>\r
       <groupId>org.slf4j</groupId>\r
           </plugin>\r
     </plugins>  \r
   </build>\r
-</project>
\ No newline at end of file
+</project>\r
index abd664e..426fbd9 100644 (file)
                        <version>${project.version}</version>
                </dependency>
 -->
+                <dependency>
+                     <groupId>ch.qos.logback</groupId>
+                     <artifactId>logback-classic</artifactId>
+                    <version>${logback.version}</version>
+                </dependency>
                <dependency>
                        <groupId>com.att.eelf</groupId>
                        <artifactId>eelf-core</artifactId>
-                       </dependency>
+                       <exclusions>
+                            <exclusion>
+                                 <groupId>ch.qos.logback</groupId>
+                                 <artifactId>logback-classic</artifactId>
+                            </exclusion>
+                        </exclusions>
+               </dependency>
                <dependency>
                        <groupId>org.onap.appc</groupId>
                        <artifactId>appc-common-bundle</artifactId>
                <dependency>
                        <groupId>org.mockito</groupId>
                        <artifactId>mockito-core</artifactId>
+                       <scope>test</scope>
                </dependency>
        </dependencies>
 
index f4ffee6..7206230 100755 (executable)
             <artifactId>sal-binding-broker-impl</artifactId>
             <scope>test</scope>
         </dependency>
-
+        <dependency>
+         <groupId>ch.qos.logback</groupId>
+         <artifactId>logback-classic</artifactId>
+        <version>${logback.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.att.eelf</groupId>
             <artifactId>eelf-core</artifactId>
+            <exclusions>
+                 <exclusion>
+                      <groupId>ch.qos.logback</groupId>
+                      <artifactId>logback-classic</artifactId>
+                 </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.onap.ccsdk.sli.adaptors</groupId>
index bf85243..d217286 100644 (file)
             <artifactId>sal-binding-broker-impl</artifactId>
             <scope>test</scope>
         </dependency>
-
+        <dependency>
+         <groupId>ch.qos.logback</groupId>
+         <artifactId>logback-classic</artifactId>
+        <version>${logback.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.att.eelf</groupId>
             <artifactId>eelf-core</artifactId>
+            <exclusions>
+                   <exclusion>
+                        <groupId>ch.qos.logback</groupId>
+                        <artifactId>logback-classic</artifactId>
+                   </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.sun.jersey</groupId>
index c762692..e9bf49a 100644 (file)
             <artifactId>state-machine-lib</artifactId>
             <version>${project.version}</version>
         </dependency>
+        <dependency>
+         <groupId>ch.qos.logback</groupId>
+         <artifactId>logback-classic</artifactId>
+        <version>${logback.version}</version>
+        </dependency>
         <dependency>
             <groupId>com.att.eelf</groupId>
             <artifactId>eelf-core</artifactId>
+            <exclusions>
+                  <exclusion>
+                       <groupId>ch.qos.logback</groupId>
+                       <artifactId>logback-classic</artifactId>
+                  </exclusion>
+            </exclusions>
         </dependency>
     </dependencies>
 
index 126e461..11d4221 100755 (executable)
                        <artifactId>commons-io</artifactId>\r
                        <version>2.5</version>\r
                </dependency>\r
-        <dependency>\r
+                <dependency>\r
                        <groupId>org.apache.commons</groupId>\r
                        <artifactId>commons-lang3</artifactId>\r
                </dependency>\r
-\r
+                <dependency>\r
+                        <groupId>ch.qos.logback</groupId>\r
+                        <artifactId>logback-classic</artifactId>\r
+                       <version>${logback.version}</version>\r
+                </dependency>\r
                <dependency>\r
                        <groupId>com.att.eelf</groupId>\r
                        <artifactId>eelf-core</artifactId>\r
+                        <exclusions>\r
+                            <exclusion>\r
+                                 <groupId>ch.qos.logback</groupId>\r
+                                 <artifactId>logback-classic</artifactId>\r
+                            </exclusion>\r
+                        </exclusions>\r
                </dependency>\r
 \r
                <dependency>\r
                                                <Bundle-SymbolicName>org.onap.appc.aai.client</Bundle-SymbolicName>\r
                                                <Bundle-Activator>org.onap.appc.aai.client.AppcAaiClientActivator</Bundle-Activator>\r
                                                <Export-Package>org.onap.appc.aai.client,org.onap.appc.aai.client.*</Export-Package>\r
-                                               <Import-Package>*</Import-Package>\r
+                                               <Import-Package>groovy.lang;resolution:=optional,\r
+                                                   org.codehaus.groovy.*;resolution:=optional,*</Import-Package>\r
                                                <DynamicImport-Package>*</DynamicImport-Package>\r
                                                <Embed-Dependency>eelf-core,logback-core,logback-classic</Embed-Dependency>\r
                                        </instructions>\r
index e2edfba..b91cbe6 100755 (executable)
             <groupId>commons-io</groupId>\r
             <artifactId>commons-io</artifactId>\r
         </dependency>\r
+        <dependency>\r
+         <groupId>ch.qos.logback</groupId>\r
+         <artifactId>logback-classic</artifactId>\r
+        <version>${logback.version}</version>\r
+        </dependency>\r
         <dependency>\r
             <groupId>com.att.eelf</groupId>\r
             <artifactId>eelf-core</artifactId>\r
+            <exclusions>\r
+                 <exclusion>\r
+                      <groupId>ch.qos.logback</groupId>\r
+                      <artifactId>logback-classic</artifactId>\r
+                 </exclusion>\r
+            </exclusions>\r
         </dependency>\r
         <dependency>\r
             <groupId>com.sun.jersey</groupId>\r
index 6252b8e..991e3ab 100644 (file)
@@ -55,7 +55,7 @@ limitations under the License.
         <apache.httpcomponents.version>4.4</apache.httpcomponents.version>
         <commons.lang3.version>3.4</commons.lang3.version>
         <antlr.version>4.5.1</antlr.version>
-        <logback.version>1.2.0</logback.version>
+        <logback.version>1.2.3</logback.version>
         <toscalib.version>1.1.0</toscalib.version>
         <sdc-client.version>1.3.0</sdc-client.version>
         <!-- Should match the version used by sdc-distribution-client -->
diff --git a/pom.xml b/pom.xml
index 15bdd07..4472c28 100644 (file)
--- a/pom.xml
+++ b/pom.xml
@@ -377,7 +377,7 @@ limitations under the License.
             <dependency>
                 <groupId>ch.qos.logback</groupId>
                 <artifactId>logback-core</artifactId>
-                               <version>${logback.version}</version>
+               <version>${logback.version}</version>
                 <scope>compile</scope>
             </dependency>
             <dependency>