Document OJSI-43 (CVE-2019-12113) vulnerability

[sdnc/oam.git] / docs / release-notes.rst

diff --git a/docs/release-notes.rst b/docs/release-notes.rst
index 7579604..fa83868 100644 (file)
--- a/docs/release-notes.rst
+++ b/docs/release-notes.rst
@@ -3,6 +3,93 @@
 Release Notes
 =============
 
+Version 1.5.3
+-------------
+:Release Date: 2019-06-13
+
+**New Features**
+
+The full list of Dublin epics and user stories for SDNC maybe be found at <https://jira.onap.org/issues/?filter=11803>.
+
+The following list summarizes some of the most significant epics:
+
++------------+----------------------------------------------------------------------------+
+| Jira #     | Abstract                                                                   |
++============+============================================================================+
+| [SDNC-551] | OpenDaylight Fluorine Support                                              |
++------------+----------------------------------------------------------------------------+
+| [SDNC-564] | 5G Use Case                                                                |
++------------+----------------------------------------------------------------------------+
+| [SDNC-565] | CCVPN Use Case Extension                                                   |
++------------+----------------------------------------------------------------------------+
+| [SDNC-570] | SDN-R: Server side component                                               |
++------------+----------------------------------------------------------------------------+
+| [SDNC-579] | SDN-R : UX-Client                                                          |
++------------+----------------------------------------------------------------------------+
+| [SDNC-631] | SDNC support for the PNF Use Case Network Assign for Plug and Play feature |
++------------+----------------------------------------------------------------------------+
+
+
+**Bug Fixes**
+The full list of bug fixes in the SDNC Dublin release may be found at <https://jira.onap.org/issues/?filter=11805>
+
+**Known Issues**
+The full list of known issues in SDNC may be found in the ONAP Jira at <https://jira.onap.org/issues/?filter=11119>
+
+**Security Notes**
+
+*Fixed Security Issues*
+
+- CVE-2019-12132 `OJSI-41 <https://jira.onap.org/browse/OJSI-41>`_ SDNC service allows for arbitrary code execution in sla/dgUpload form
+  Fixed temporarily by disabling admportal
+- CVE-2019-12123 `OJSI-42 <https://jira.onap.org/browse/OJSI-42>`_ SDNC service allows for arbitrary code execution in sla/printAsXml form
+  Fixed temporarily by disabling admportal
+- CVE-2019-12113 `OJSI-43 <https://jira.onap.org/browse/OJSI-43>`_ SDNC service allows for arbitrary code execution in sla/printAsGv form
+  Fixed temporarily by disabling admportal
+
+*Known Security Issues*
+
+*Known Vulnerabilities in Used Modules*
+
+Quick Links:
+
+- `SDNC project page <https://wiki.onap.org/display/DW/Software+Defined+Network+Controller+Project>`_
+- `Passing Badge information for SDNC <https://bestpractices.coreinfrastructure.org/en/projects/1703>`_
+- `Project Vulnerability Review Table for Casablanca Release <https://wiki.onap.org/pages/viewpage.action?pageId=45307811>`_
+
+Version: 1.4.4
+--------------
+
+**Bugs Fixes**
+
+The following bugs are fixed in the SDNC Casablanca January 2019 maintenance release:
+
++------------+------------------------------------------------------------------------------------------+
+| Jira #     | Abstract                                                                                 |
++============+==========================================================================================+
+| [SDNC-405] | SDNC API documentation is missing on ReadTheDocs                                         |
++------------+------------------------------------------------------------------------------------------+
+| [SDNC-523] | vnf-information.vnf-id validation check should not be mandatory in validate-vnf-input DG |
++------------+------------------------------------------------------------------------------------------+
+| [SDNC-532] | oof query failed due to hostname change, returning unknown host                          |
++------------+------------------------------------------------------------------------------------------+
+| [SDNC-534] | wrong "input" field in DMaaP message template                                            |
++------------+------------------------------------------------------------------------------------------+
+| [SDNC-536] | Upgrade zjsonpatch version to remediate vulnerabilities                                  |
++------------+------------------------------------------------------------------------------------------+
+| [SDNC-537] | Update to spring-boot 2.1.0-RELEASE                                                      |
++------------+------------------------------------------------------------------------------------------+
+| [SDNC-540] | CCVPN closed loop testing failed.                                                        |
++------------+------------------------------------------------------------------------------------------+
+| [SDNC-542] | [PORT] Network Discovery microservice does not log                                       |
++------------+------------------------------------------------------------------------------------------+
+| [SDNC-546] | CCVPN bugs fix for manual free integration test                                          |
++------------+------------------------------------------------------------------------------------------+
+| [SDNC-549] | Retain MD-SAL data on pod recreate                                                       |
++------------+------------------------------------------------------------------------------------------+
+
+
+
 Version: 1.4.3
 --------------
 
@@ -160,5 +247,3 @@ in release 1.2.1:
 
 **Other**
        NA
-
-