Conductor 3.13.2 vulnerabilities Critical : Blocked in Production

[shekarpcs]

We got following vulnerabilities and blocked us going to production with 3.13.2.

<title></title> <style type="text/css"> p.p1 {margin: 0.0px 0.0px 0.0px 0.0px; font: 11.0px Helvetica} p.p2 {margin: 0.0px 0.0px 0.0px 0.0px; text-align: right; font: 11.0px Helvetica} p.p3 {margin: 0.0px 0.0px 0.0px 0.0px; text-align: right; font: 11.0px Helvetica; min-height: 13.0px} table.t1 {border-collapse: collapse} td.td1 {border-style: solid; border-width: 1.0px 1.0px 1.0px 1.0px; border-color: #bfbfbf #bfbfbf #bfbfbf #bfbfbf; padding: 0.0px 5.0px 0.0px 5.0px} </style>

important	8.1	under investigation	CVE-2022-37454	The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	https://access.redhat.com/security/cve/CVE-2022-37454	image	python-libs	2.7.5-92.el7_9
important	6.4	fixed in 1.15.1-55.el7_9	CVE-2022-42898	Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).  Security Fix(es):  * krb5: integer overflow vulnerabilities in PAC parsing (CVE-2022-42898)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.	https://access.redhat.com/security/cve/CVE-2022-42898	image	krb5-libs	1.15.1-54.el7_9
important	8.1	under investigation	CVE-2022-37454	The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	https://access.redhat.com/security/cve/CVE-2022-37454	image	python	2.7.5-92.el7_9
critical	9.8		CVE-2019-17571	Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	https://nvd.nist.gov/vuln/detail/CVE-2019-17571	image	log4j_log4j	1.2.15
critical	9.8		CVE-2022-23305	By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	https://nvd.nist.gov/vuln/detail/CVE-2022-23305	image	log4j_log4j	1.2.15
critical	9.8	fixed in 2.0	CVE-2020-9493	A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	https://nvd.nist.gov/vuln/detail/CVE-2020-9493	image	log4j_log4j	1.2.15
critical	9.1	fixed in 4.1.44	CVE-2019-20444	HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	https://nvd.nist.gov/vuln/detail/CVE-2019-20444	image	org.jboss.netty_netty	3.2.2.Final
critical	9.1	fixed in 4.1.44	CVE-2019-20445	HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	https://nvd.nist.gov/vuln/detail/CVE-2019-20445	image	org.jboss.netty_netty	3.2.2.Final

[manan164]

Hi @shekarpcs , Can you please describe the issue in detail

1. Which CVE scan tool you are using?
2. I don't see python-libs and jboss.netty_netty as direct/indirect dependencies. Are you using python to execute worker tasks?
3. We will update log4j to 2.17.1

[shekarpcs]

We are using prisma scan.

Community version has python and netty. We switched to netflix conductor main version with postgres using PropertyLauncher.

We are using following method to launch main version conductor with postgres libraries

java -cp conductor-server-3.13.2-boot.jar -Dloader.path=/lib -Dloader.main=com.netflix.conductor.Conductor org.springframework.boot.loader.PropertiesLauncher

/lib has postgres jar with all dependency jar files.

We have to come up with this solution to keep conductor clean and free of vulnerabilities. We cannot use gradle to build in our enterprise. We are getting conductor jar and postgres jar from the Mavennexus and starting using above method.