Quesnelia: Upgrade Vertx from 4.5.5 to 4.5.9 fixing Snappy vulns
Description
CSP Request Details
1. Describe issue impact on business
Data loss because Kafka crashes.
2. What institutions are affected? (field “Effected Institutions” in Jira to be populated)
All institutions that use loans, requests or check-ins. Attackers don't advertise which institutions they will attack.
3. What is the workaround if exists?
None.
4. What areas will be impacted by fix (i.e. what areas need to be retested)
Upgrading the Vert.x software library patch version doesn't need any testing beyond existing unit tests.
5. Brief explanation of technical implementation and the level of effort (in workdays) and technical risk (low/medium/high)
Low. Bump Vert.x software library patch version.
6. Brief explanation of testing required and level of effort (in workdays). Provide test plan agreed with by QA Manager and PO.
None beyond existing unit tests.
7. What is the roll back plan in case the fix does not work?
Downgrade to previous mod-circulation-storage patch version.
CSP Rejection Details
None
Potential Workaround
None
Checklist
hideActivity
Show:
Oleksii Petrenko September 2, 2024 at 3:56 PM
Deployed to QBF
Done
Details
Details
Assignee
Julian Ladisch
Julian LadischReporter
Julian Ladisch
Julian LadischPriority
Story Points
0
Sprint
None
Development Team
Vega
Release
Quesnelia (R1 2024) Service Patch #4
RCA Group
Related dependency upgrade
CSP Approved
Yes
Affected releases
Quesnelia (R1 2024)
TestRail: Cases
Open TestRail: Cases
TestRail: Runs
Open TestRail: Runs
Created August 5, 2024 at 8:29 AM
Updated October 29, 2024 at 1:31 PM
Resolved August 22, 2024 at 1:35 PM
TestRail: Cases
TestRail: Runs
Upgrade Vert.x from 4.5.5 to 4.5.9.
This indirectly upgrades snappy-java from 1.1.10.0 to 1.1.10.5 fixing these vulnerablities:
https://nvd.nist.gov/vuln/detail/CVE-2023-34455 Denial of Service (DoS)
https://nvd.nist.gov/vuln/detail/CVE-2023-34453 Integer Overflow or Wraparound
https://nvd.nist.gov/vuln/detail/CVE-2023-34454 Integer Overflow or Wraparound
( https://nvd.nist.gov/vuln/detail/CVE-2023-43642 Allocation of Resources Without Limits or Throttling – affects decompression only, mod-circulation-storage is Kafka producer only and therefore is not affected )