Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Next »

The following is a list of known EdgeX security issues and vulnerabilities – and any associated Common Vulnerabilities and Exposures (CVE) reports to accompany the issue. CVE is a program for identifying, cataloging and addressing software and firmware vulnerabilities (see https://cve.mitre.org/).  Nationally, the federal government runs the CVE program to help build a free, standardized list or dictionary of security vulnerabilities for organizations to use to improve their software’s exposure and posture to security threats.

EdgeX grades security issues on the CVSS(Common Vulnerability Scoring System) scale.  The four levels are critical, high, medium and low level issues.

ComponentDescriptionSeverityAffected ReleasesIssue LinkFix TimelineResolution/Mitigation 
Database - MongoDBMongoDB is one of the data persistence solutions useable in EdgeX. The MongoDB 3.4.9 container base image  has known vulnerabilities stemming from its underlying base Linux image and some from MongoDB source itself..Medium

Delhi

Edinburgh

https://www.cvedetails.com/vulnerability-list/vendor_id-12752/product_id-25450/version_id-229891/Mongodb-Mongodb-3.4.9.htmlFuji

Pulling 4.0-xenial MongoDB package, which starts with a Debian base image that does not include a host of insecurities spanning Perl, OpenSSL etc, and some MongoDB specific fixes.

https://github.com/edgexfoundry/docker-edgex-mongo/commit/2c86e5e4359367177dc339556604c3af6fb9ee2a

Database access credentials in the clear

MongoDB and Redis are the available data persistence layers in EdgeX. While the access credentials (username and password) are in the clear for MongoDB, located in the configuration service (aka Consul) or on the local file system, Redis defaults to no authentication.  High

Delhi

Edinburgh


Fuji

EdgeX-using organizations should turn on the database access controls and institute a means to secure the data access credentials provided to the services.

Go net package vulnerabilities

net/http: Denial of Service vulnerabilities (ping and reset) in the HTTP/2 implementation


and 

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number.

High, High, Critical

Delhi

Edinburgh


https://nvd.nist.gov/vuln/detail/CVE-2019-9512

https://nvd.nist.gov/vuln/detail/CVE-2019-9514

https://nvd.nist.gov/vuln/detail/CVE-2019-14809

CVE-2019-9512 and CVE-2019-9514, and Go issue golang.org/issue/33606.

net/url: parsing validation issue

CVE-2019-14809 and Go issue golang.org/issue/29098.

Fuji










































  • No labels