Code Monkey home page Code Monkey logo

plexus-interop's Introduction

FINOS - Archived

This project is archived, which means that it's in read-only state; you can download and use this code, but please be aware that it may be buggy and may also contain security vulnerabilities. If you're interested in restoring development activities on this project, please email [email protected]

Plexus Interop

Overview

The Plexus Interop project aims to define an open standard for desktop application interoperability and provides reference implementation of this standard. It formalizes connections between applications within a single user session on client desktop through a central broker.

The main goal is to enable development of extensible workflows connecting independent apps developed by different organizations in different technologies (.NET, Web, Java, Python, etc.) by passing relevant context (structured data objects) between those apps.

Although the industry is moving towards containerized desktop applications, Plexus Interop recognizes that much of the application landscape is not yet tied to containers and is architecturally agnostic of container implementation. Separating interoperability from the container provides notable advantages: different containers can be leveraged in the same workflow, and launched applications residing outside of containers can participate in interop activities.

Technically speaking, Plexus Interop is a metadata-centric language-agnostic desktop app-to-app interoperability framework with an extensible model for launching new instances of desktop applications on demand. Its extensibility is based on open standards which are essential parts of the project. The architecture is based around central broker providing hub-and-spoke connectivity between apps and brokering strongly-typed RPC-style calls between them. The broker has a connection to an Application Lifecycle Manager (or Launcher) which is capable of creating new instances of apps based on the their runtime-metadata (e.g. container type, launch command, command line parameters) defined in a registry.

Key components and high level architecture

Raising an Issue

  • Please raise issues to the project mailing list [email protected] (Web Archive). Some people from project teams currently can't access build-in github issue tracker from corporate network.
  • Please also tag the new issue with either "Bug" or "Enhancement".

Repository Overview

Plexus Interop repository consist of the following main sections:

  • desktop - Interop Broker, .NET Interop Client and sample apps implemented in C# using .NET Core 2.0.
  • web - Web Interop Client and sample apps implemented in TypeScript.
  • dsl - Protobuf and Plexus Interop grammar parsers, validators and code-generators implemented using Xtext framework.
  • docs - documentation implemented in AsciiDoc format using Asciidoctor processor.
  • protocol - definitions of Plexus Interop protocol messages in Protobuf format.
  • samples - sample interop metadata.

Build and samples are currently tested on Windows environments; building and running on Linux/OSX environments is still experimental (see below).

Build/Install

General

Make sure that Java SDK is installed and JAVA_HOME variable is set.

All Plexus Interop components can be built using Gradle tool using the following single command:

./gradlew build --console plain

Build produces artifacts into folder "bin"; the first run can take 10 minutes or more, depending on your Internet connection speed.

Build in restricted environment

Build configuration should work fine on standard setup, with access to Internet. However it is quite often to have Dev setup behind corporate proxy. To run build successfully you'll need to adjust few configuration items shown below:

Gradle Proxy Settings

To adjust Gradle Proxy settings please update following lines in %USERPROFILE%\.gradle\gradle.properties, using your Corporate Proxy's host and port instead of example values:

systemProp.proxySet="true"
systemProp.http.proxyHost=proxy.host.acme.com
systemProp.http.proxyPort=8080
systemProp.https.proxyHost=proxy.host.acme.com
systemProp.https.proxyPort=8080
systemProp.http.nonProxyHosts=*.acme.com|localhost

Environment variables

Please adjust following Environment variables:

Name Value/Example Description
HTTP_PROXY http://userproxy.acme.com:8080 Your corporate proxy host:port.
HTTPS_PROXY http://userproxy.acme.com:8080 Your corporate proxy host:port.
NO_PROXY 127.0.0.1,localhost,.acme.com List of Intranet hosts to exclude from accessing through proxy.
ELECTRON_MIRROR https://github.com/electron/electron/releases/ Host to download Electron binaries from, if different from default Github releases site.
SASS_BINARY_SITE https://github.com/sass/node-sass/releases/ Host to download Saas binaries from, if different from default Github releases site.

There are also few recommended/optional variables to improve your build/development experience:

Name Value/Example Description
PLEXUS_BUILD_SKIP_DOTNET_TESTS true Disable integration tests for .Net components to decrease build time.
PLEXUS_BUILD_SKIP_WEB_TESTS true Disable integration tests for Javascript components to decrease build time.
GRADLE_USER_HOME C:\Home\Gradle Gradle stores cached packages in %USERPROFILE%\.gradle by default, often pointing to Roaming Profile. So it worth to use some local folder instead. Please also copy existing Gradle settings to new folder.
NUGET_PACKAGES C:\Home\NuGetGlobalPackages Nuget stores cached binaries in %USERPROFILE%\.nuget by default, often pointing to Roaming Profile. So it worth to use some local folder instead.
NPM_REGISTRY_INSTALL https://npm.registry.acme.com Can be used to replace default https://registry.npmjs.org with another registry/mirror to download NPM dependencies from.

Using OSX

If running on OSX, please update desktop/src/Plexus.Interop.sln file and remove any code block that starts with ProjectSection(ProjectDependencies) and ends with EndSection; if you have already executed the gradlew build once, you must cleanup your local checkout using git clean -d -f -X (add -n for a dry run).

Running Samples

After successful build samples binaries will be located in bin directory.

Run .Net to Web interop example on Windows:

  • Go to bin/win-x86/samples/greeting (or bin/osx-x64/samples/greeting for OSX/Linux)

  • Launch Broker – LaunchBroker.cmd (or LaunchBroker.sh for OSX/Linux)

  • Launch (from a different terminal) Greeting Client – LaunchGreetingClient.cmd

    • Choose “Discovery” option (5) and “Greeting from Electron Web app” from discovery response

    Sample-1

    • Enter name, e.g. “John” and hit enter – Web Greeting Server app will be launched by Broker, print Greeting Request:

    Sample-2

    • And send response back to .Net Greeting Client

    Sample-3

    • Then choose Discovery (5) and “Greeting from .Net app” from discovery response
    • Enter another name, e.g. “Mike” and hit enter - .Net Greeting Server app will be launched and print greeting request:

    Sample-4

Documentation

To check out docs, visit https://plexus.finos.org.

Documentation project is located in folder 'docs'. We build documentation using AsciiDoc.

To render diagrams during the build you need to have graphviz installed on the machine.

Invoke the following command to run the documentation build:

gradlew -p docs --console plain

After successful build documentation is available via:

bin/docs/html5/index.html

Contributing

  1. Fork it (https://github.com/finos/plexus-interop/fork)
  2. Create your feature branch (git checkout -b feature/fooBar)
  3. Read our contribution guidelines and Community Code of Conduct
  4. Commit your changes (git commit -am 'Add some fooBar')
  5. Push to the branch (git push origin feature/fooBar)
  6. Create a new Pull Request

NOTE: Commits and pull requests to FINOS repositories will only be accepted from those contributors with an active, executed Individual Contributor License Agreement (ICLA) with FINOS OR who are covered under an existing and active Corporate Contribution License Agreement (CCLA) executed with FINOS. Commits from individuals not covered under an ICLA or CCLA will be flagged and blocked by the FINOS Clabot tool. Please note that some CCLAs require individuals/employees to be explicitly named on the CCLA.

Need an ICLA? Unsure if you are covered under an existing CCLA? Email [email protected]

Troubleshooting

Problem: Gradle fails to download dependencies, how to setup proxy configuration?

Solution: Pass proxy settings into Gradle via command-line parameters - e.g. gradlew.bat -Dhttp.proxyHost=myproxy.com -Dhttp.proxyPort=8888 -Dhttps.proxyHost=myproxy.com -D https.proxyPort=4444 ...

Updating public documentation

As described above, public documentation is served using GitHub Pages and stored in gh-pages branch. So to update it, you simply need to push updated documentation to this branch. gh-pages branch structure is different from master, so manual update requires few steps:

  • Clone (if haven't cloned it yet) repository to plexus-interop folder
  • Clone another copy of repository to separate plexus-interop-docs folder, checkout gh-pages branch there
  • Create branch for documentation update, e.g. git checkout -b feature/gh-pages-update
  • Return back to folder with main line branch, build documentation gradlew build -p docs --console plain
  • Copy documentation sources - plexus-interop/docs to plexus-interop-docs/docs
  • Copy generated documentation - plexus-interop/bin/html5 to plexus-interop-docs (project root)
  • Go to plexus-interop-docs, push the changes and raise PR against gh-pages branch

License

The code in this repository is distributed under the Apache License, Version 2.0.

Copyright 2017-2019 Plexus Interop Deutsche Bank AG

plexus-interop's People

Contributors

agitana avatar alexey-ogarkov-db avatar alexogar avatar anton-selyutin-db avatar brntbeer avatar dependabot[bot] avatar dmitry-bedrin-db avatar finos-admin avatar iskender-kamchibekov-db avatar maoo avatar maxwellhays avatar mend-for-github-com[bot] avatar nikoant avatar svyatoslav-kryukov-db avatar toryant avatar udalmik avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

plexus-interop's Issues

Plexus team to confirm all plexus-interop code resides in the plexus-interop repository

Plexus team to confirm all plexus-interop code resides in the plexus-interop repository

Description of Problem:

As part of a code consolidation exercise and repo migration to FINOS, the FINOS team would like to confirm all code related to plexus-interop resides in the plexus-interop repository.

If any plexus-interop code resides in unrelated repositories, such as finos-plexus.github.io, the code should be migrated into plexus-interop.

CVE-2017-16028 (Medium) detected in randomatic-1.1.7.tgz

CVE-2017-16028 - Medium Severity Vulnerability

Vulnerable Library - randomatic-1.1.7.tgz

Generate randomized strings of a specified length, fast. Only the length is necessary, but you can optionally generate patterns using any combination of numeric, alpha-numeric, alphabetical, special or custom characters.

Library home page: https://registry.npmjs.org/randomatic/-/randomatic-1.1.7.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/randomatic/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • gulp-symdest-1.1.0.tgz
      • vinyl-fs-2.4.4.tgz
        • glob-stream-5.3.5.tgz
          • micromatch-2.3.11.tgz
            • braces-1.8.5.tgz
              • expand-range-1.8.2.tgz
                • fill-range-2.2.3.tgz
                  • randomatic-1.1.7.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).

Publish Date: 2018-06-04

URL: CVE-2017-16028

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/157

Release Date: 2017-04-14

Fix Resolution: Update to version 3.0.0 or later.

Plexus PMC to confirm life cycle status of the Plexus Interop Project

Plexus PMC to confirm life cycle status of the Plexus Interop Project

Description of Problem:

The current lifecycle stage of the Plexus Interop Project in the project metadata is "INCUBATING", but there's reason to believe this status should be "ACTIVE". 

Potential Solutions:

Can the Plexus PMC lead review the revised FINOS activation life cycle criteria and recommend the PMC officially votes to move the project to "ACTIVE" based on the revised criteria.

https://finosfoundation.atlassian.net/wiki/spaces/FINOS/pages/75530376/Activation

Alternatively, the Plexus PMC can suggest the project stays in "INCUBATING", but will need to suggest the steps needed, based on the criteria, to move the project to active

  • i.e., propose the plan to get the project from "INCUBATING" to "ACTIVE" and who specifically needs to do what when

Plexus team to confirm Plexus Desktop Interop API project code

Plexus team to confirm Plexus Desktop Interop API project code

Description of Problem:

As part of a code consolidation exercise and repo migration to FINOS, the FINOS team would like to reconfirm the location of the Plexus Desktop Interop API prior to the migration of repositories.

Can the Plexus team confirm the following TypeScript file relates to the API contribution and also provide details of any other related API contributions prior to consolidation and migration.

https://github.com/finos-plexus/finos-plexus.github.io/blob/master/client-api/client-api.ts

Transitive dependency on `flatmap-stream`

There is a transitive dependency in the project to a package flatmap-stream that has been removed from npm due to identified vulnerabilities.

This makes it not possible to build the solution on a fresh install.

CVE-2018-16492 (High) detected in extend-3.0.1.tgz

CVE-2018-16492 - High Severity Vulnerability

Vulnerable Library - extend-3.0.1.tgz

Port of jQuery.extend for node.js and the browser

Library home page: https://registry.npmjs.org/extend/-/extend-3.0.1.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/extend/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • request-2.85.0.tgz
      • extend-3.0.1.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16492

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/381185

Release Date: 2019-02-01

Fix Resolution: extend - v3.0.2,v2.0.2

Roadmap

  • Projects share and work to a public roadmap, aligned with the overall program roadmap.

Status Badging

  • Project Team commits to adopt the FINOS Active badge in the README.md once PMC approves activation properly signal adopters the new state of the Project

CVE-2019-1010266 (Medium) detected in lodash-4.17.10.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/lodash/package.json

Dependency Hierarchy:

  • vsce-1.40.0.tgz (Root Library)
    • lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11

What it means for the Project Team?

Plexus demonstrates the following

  • Increased visibility and positioning in FINOS Web Resources
  • Increased visibility and positioning in FINOS Marketing
  • Increased visibility and positioning in FINOS Community building efforts
    • Meetups
    • Blog posts
    • Etc ...

WS-2019-0019 (Medium) detected in braces-1.8.5.tgz

WS-2019-0019 - Medium Severity Vulnerability

Vulnerable Library - braces-1.8.5.tgz

Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.

Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/braces/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • gulp-symdest-1.1.0.tgz
      • vinyl-fs-2.4.4.tgz
        • glob-stream-5.3.5.tgz
          • micromatch-2.3.11.tgz
            • braces-1.8.5.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2019-03-25

URL: WS-2019-0019

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/786

Release Date: 2019-02-21

Fix Resolution: 2.3.1

WS-2018-0103 (Medium) detected in stringstream-0.0.5.tgz

WS-2018-0103 - Medium Severity Vulnerability

Vulnerable Library - stringstream-0.0.5.tgz

Encode and decode streams into string streams

Library home page: https://registry.npmjs.org/stringstream/-/stringstream-0.0.5.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/stringstream/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • request-2.85.0.tgz
      • stringstream-0.0.5.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

All versions of stringstream are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below.

Publish Date: 2018-05-16

URL: WS-2018-0103

CVSS 2 Score Details (5.2)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/664/versions

Release Date: 2019-06-05

Fix Resolution: 0.0.6,1.0.0

FINOS branding to be added to Plexus microsite : https://finos-plexus.github.io/plexus-interop/

FINOS branding to be added to Plexus microsite : https://finos-plexus.github.io/plexus-interop/

Description of Problem:

The Plexus microsite is currently missing FINOS branding which allows contributors and consumers know Plexus is part of the Fintech Open Source Foundation.

FINOS brand assets can be found in the following repo

Potential Solutions:

Plexus PMC to schedule adding FINOS branding to the Plexus microsite and providing the collaboration instructions to [email protected]

CVE-2018-3774 (High) detected in url-parse-1.4.0.tgz

CVE-2018-3774 - High Severity Vulnerability

Vulnerable Library - url-parse-1.4.0.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.0.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/url-parse/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • url-parse-1.4.0.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

Publish Date: 2018-08-12

URL: CVE-2018-3774

CVSS 3 Score Details (10.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3774

Release Date: 2018-08-12

Fix Resolution: 1.4.3

Versioning

  • Project software is production grade and ready for large scale consumption.
  • 1.0.0 version was released and announced it to the FINOS announce@ mailing list.

Project Team

  • Project Team has/have demonstrated active involvement in PMC and have demonstrated commitment to furthering overall Program goals

What it means for consumers?

Plexus demonstrates the following

  • High Quality
  • Mature Codebase
  • Mature Community Dynamics perspective
  • Produces valuable releases to solve a useful business problem for our Community

CVE-2019-10744 (High) detected in lodash-4.17.10.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/lodash/package.json

Dependency Hierarchy:

  • vsce-1.40.0.tgz (Root Library)
    • lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@a01e4fa

Release Date: 2019-07-08

Fix Resolution: 4.17.12

Usefulness

  • The Project demonstrably solves a real life use case in the Community.
  • Evidence of adoption beyond the contributing individuals or firms (e.g., in the form of download statistics, listing known deployments or implementations, etc.)

CVE-2019-20149 (Medium) detected in multiple libraries

CVE-2019-20149 - Medium Severity Vulnerability

Vulnerable Libraries - kind-of-4.0.0.tgz, kind-of-3.2.2.tgz, kind-of-1.1.0.tgz

kind-of-4.0.0.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-4.0.0.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/randomatic/node_modules/kind-of/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • gulp-symdest-1.1.0.tgz
      • vinyl-fs-2.4.4.tgz
        • glob-stream-5.3.5.tgz
          • micromatch-2.3.11.tgz
            • braces-1.8.5.tgz
              • expand-range-1.8.2.tgz
                • fill-range-2.2.3.tgz
                  • randomatic-1.1.7.tgz
                    • kind-of-4.0.0.tgz (Vulnerable Library)
kind-of-3.2.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/is-number/node_modules/kind-of/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • gulp-symdest-1.1.0.tgz
      • vinyl-fs-2.4.4.tgz
        • glob-stream-5.3.5.tgz
          • micromatch-2.3.11.tgz
            • braces-1.8.5.tgz
              • expand-range-1.8.2.tgz
                • fill-range-2.2.3.tgz
                  • is-number-2.1.0.tgz
                    • kind-of-3.2.2.tgz (Vulnerable Library)
kind-of-1.1.0.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-1.1.0.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/kind-of/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • gulp-filter-5.1.0.tgz
      • plugin-error-0.1.2.tgz
        • extend-shallow-1.1.4.tgz
          • kind-of-1.1.0.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 2 Score Details (5.0)

Base Score Metrics not available

CVE-2018-3728 (High) detected in hoek-2.16.3.tgz

CVE-2018-3728 - High Severity Vulnerability

Vulnerable Library - hoek-2.16.3.tgz

General purpose node utilities

Library home page: https://registry.npmjs.org/hoek/-/hoek-2.16.3.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/hoek/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • gulp-remote-src-0.4.3.tgz
      • request-2.79.0.tgz
        • hawk-3.1.3.tgz
          • hoek-2.16.3.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-03-30

URL: CVE-2018-3728

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3728

Release Date: 2018-03-30

Fix Resolution: 4.2.1,5.0.3

Development Process

The Project adopts best-of-breed standards of distributed software development, including but not limited to:

Documentation

The README.md must include or reference up to date:

  • End user docs including ...
    • A description of the software
    • Feature overview
    • Installation & configuration instructions
  • Developer docs including links to other external systems (further docs, wiki, CI & validation tools, artefact repository, change log / history, etc.)
  • Where possible badges (e.g. from shields.io) are encouraged
  • Sample code explaining how to use the project, library, standard, SDK, etc.

WS-2018-0590 (High) detected in diff-3.3.1.tgz

WS-2018-0590 - High Severity Vulnerability

Vulnerable Library - diff-3.3.1.tgz

A javascript text diff implementation.

Library home page: https://registry.npmjs.org/diff/-/diff-3.3.1.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/diff/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • mocha-4.1.0.tgz
      • diff-3.3.1.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Publish Date: 2019-06-11

URL: WS-2018-0590

CVSS 2 Score Details (7.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: kpdecker/jsdiff@2aec429

Release Date: 2019-06-11

Fix Resolution: 3.5.0

In Plexus metadata, rename "project-desktop-interop" to "Plexus Desktop Interop API Project"

In Plexus metadata, rename "project-desktop-interop" to "Plexus Desktop Interop API Project"

Description of Problem:

In the Plexus metadata, the API project is named "project-desktop-interop". This should be named "Plexus Desktop Interop API Project" to include the program where the project is contained.

Potential Solutions:

In the Plexus metadata, the project name should be changed from "project-desktop-interop" to "Plexus Desktop Interop API Project".

Transparency

  • Project Team has adopted a transparent governance model(*) consistent with FINOS Community governance
  • Work for new contributors is organised into issues within a public issue tracking system
    • As appropriate, tagged as "Good First Issues"

(*) transparent governance model is when a project’s discussions, minutes, deliberations, project plans, issue tracking plans for new features, and other artefacts are open, public, and easily accessible in the FINOS Project Infrastructure or FINOS sanctioned external system.

Trademark

  • Community is using a different established Project name or original contribution trademark is owned by FINOS.
  • All Project related websites and assets are owned and hosted by FINOS.

License

  • The project must not have dependencies which effectively restrict how the project may be distributed or deployed and
  • The project must not depend on any proprietary third-party components for their core functionality.

Migrate Plexus-Interop project to FINOS organisation on GitHub

Description

This task describes migrating plexus-interop from the finos-plexus organisation into the primary finos GitHub organisation following the migration of plexus-interop-desktop-api as described in issue #174.

Solution

  • FINOS schedules and migrates plexus-interop from the finos-plexus organisation into the finos organisation on GitHub.
  • FINOS notifies the Plexus team of change and supplies URL to plexus-interop on finos.
  • Plexus engages the project as normal in accordance with the GitHub Transferring a Repository article highlighted below.

What's transferred with a repository?

https://help.github.com/en/enterprise/2.18/user/github/administering-a-repository/transferring-a-repository

When you transfer a repository, its issues, pull requests, wiki, stars, and watchers are also transferred. If the transferred repository contains webhooks, services, secrets, or deploy keys, they will remain associated after the transfer is complete. Git information about commits, including contributions, is preserved. In addition:

  • If the transferred repository is a fork, then it remains associated with the upstream repository.

  • If the transferred repository has any forks, then those forks will remain associated with the repository after the transfer is complete.

  • If the transferred repository uses Git Large File Storage, all Git LFS objects are automatically moved. This transfer occurs in the background, so if you have a large number of Git LFS objects or if the Git LFS objects themselves are large, it may take some time for the transfer to occur.

  • When a repository is transferred between two user accounts, issue assignments are left intact. When you transfer a repository from a user account to an organization, issues assigned to members in the organization remain intact, and all other issue assignees are cleared. Only owners in the organization are allowed to create new issue assignments. When you transfer a repository from an organization to a user account, only issues assigned to the repository's owner are kept, and all other issue assignees are removed.

  • If the transferred repository contains a GitHub Pages site, then links to the Git repository on the Web and through Git activity are redirected. However, we don't redirect GitHub Pages associated with the repository.

  • All links to the previous repository location are automatically redirected to the new location. When you use git clone, git fetch, or git push on a transferred repository, these commands will redirect to the new repository location or URL. However, to avoid confusion, we strongly recommend updating any existing local clones to point to the new repository URL. You can do this by using git remote on the command line:

$ git remote set-url origin new_url
For more information, see Changing a remote's URL

Migration of Plexus microsite to Docusaurus and commit to GitHub repository for site build and release

Migration of Plexus microsite to Docusaurus and commit to GitHub repository for site build and release

Description of Problem:

All Plexus microsite content currently resides outside a Plexus repository on GitHub. This means contributors cannot raise pull requests on microsite content.

To be consistent with FINOS microsite builds, Plexus content should be migrated to Docusaurus and committed to a Plexus repository on GitHub for continuous build and deployment.

Potential Solutions:

CVE-2019-13173 (High) detected in fstream-1.0.11.tgz

CVE-2019-13173 - High Severity Vulnerability

Vulnerable Library - fstream-1.0.11.tgz

Advanced file system stream things

Library home page: https://registry.npmjs.org/fstream/-/fstream-1.0.11.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/fstream/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • gulp-untar-0.0.6.tgz
      • tar-2.2.1.tgz
        • fstream-1.0.11.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.

Publish Date: 2019-07-02

URL: CVE-2019-13173

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13173

Release Date: 2019-07-02

Fix Resolution: 1.0.12

Meeting Hygiene

If the project meets regularly on-line the Project Team has demonstrated a track record of ...

  • Publishing and distributing agenda no less than 24 hours before the meeting
  • Publishes meeting minutes after calls

Build and Release

Plexus demonstrates the following

  • The Project code/documentation release process is automated or at lest well documented

If code is published ... (which applies to Plexus)

  • Publicly redistributed release binaries should be listed or referred to in the documentation. e.g.
    • Under the FINOS namespace
    • In an artefact repository or package manager, e.g.
      • NPM
      • Maven Central
      • etc

Community Inquiries

  • Community inquiries on the project channels (mailing lists, issues and pull requests, etc) are generally promptly answered

Plexus PMC to confirm life cycle status of the Plexus Desktop Interop API Project

Plexus PMC to confirm life cycle status of the Plexus Desktop Interop API Project

Description of Problem:

The current lifecycle stage of the Plexus Desktop Interop API Project in the project metadata is "ACTIVE" rather than "INCUBATING". 

Potential Solutions:

Plexus PMC lead to review the revised FINOS activation life cycle criteria and confirm the Plexus Desktop Interop API Project is demonstrating the correct "ACTIVE" status based on the revised criteria below.

https://finosfoundation.atlassian.net/wiki/spaces/FINOS/pages/75530376/Activation

If the Plexus Desktop Interop API Project should be "INCUBATING" this needs to be reflected in the project metadata and a PMC vote organised to promote the status to "ACTIVE" if and when required.

CVE-2018-1000620 (High) detected in cryptiles-2.0.5.tgz, cryptiles-3.1.2.tgz

CVE-2018-1000620 - High Severity Vulnerability

Vulnerable Libraries - cryptiles-2.0.5.tgz, cryptiles-3.1.2.tgz

cryptiles-2.0.5.tgz

General purpose crypto utilities

Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-2.0.5.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/cryptiles/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • gulp-remote-src-0.4.3.tgz
      • request-2.79.0.tgz
        • hawk-3.1.3.tgz
          • cryptiles-2.0.5.tgz (Vulnerable Library)
cryptiles-3.1.2.tgz

General purpose crypto utilities

Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-3.1.2.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/request/node_modules/cryptiles/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • request-2.85.0.tgz
      • hawk-6.0.2.tgz
        • cryptiles-3.1.2.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.

Publish Date: 2018-07-09

URL: CVE-2018-1000620

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-1000620

Release Date: 2019-04-08

Fix Resolution: 4.1.2

Security

Plexus demonstrates the following

  • No OWASP Top 10 warnings are present in the code
  • No long-standing medium or higher vulnerabilities (2+ months)
  • Proper security disclosure processes
  • Any cryptographic functions and key lengths used within the software should be identified and vetted with Foundation's legal counsel in order to request compliance with U.S. Export policy.

Community

Plexus demonstrates the following

  • Project has active participation from 2+ independent individuals and/or organizations
  • Ideally Project Team members who make contributions in connection with their employment are doing do as part of their regular job duties.

Progress

  • The project has progressed against its public roadmap during incubation;
  • The roadmap is aligned with, and where applicable incorporated into, the overall program roadmap or backlog

Activating the FINOS Plexus-Interop Project

Description of Activation Epic

Virtually all FINOS hosted projects are expected to strive towards, and ultimately attain, Active status.

This indicates to potential consumers that the project has reached a level of maturity, both functional and non-functional, that it is suitable for production use.

A full description of FINOS project activation is linked below where more detail can be found.

Initiating Activation

For a project to become Active, it must be reviewed and the change formally approved by the PMC of the Program the project is hosted in.

Any project team may initiate this approval process at any time, which involves:

  • Preparing an information packet demonstrating that they've met the requirements for activation (see below for details)
  • Submitting the packet to the appropriate PMC mailing list, requesting an activation vote.

Approval Process

  • Activation votes are performed by the PMC using the Foundation's standard Decision Making Mechanism, and only after any outstanding questions or clarifications are answered by the project team.
Activation (promotion to Active State)
What it means for consumers? The Project is high quality, mature from a codebase and community dynamics perspective. The Project produces valuable releases to solve a useful business problem for our Community. #148
What it means for the Project Team? Glory in the Community
Increased visibility and positioning in FINOS web resources, marketing and Community building efforts like meetups, blog posts, etc. #149
QUALITY & SECURITY
Development Process

The Project adopts best-of-breed standards of distributed software development, including but not limited to:

  • semantic versioning
  • tagging / branch protection
  • continuous integration ("CI") and continuous delivery ("CD") where applicable

If Project Team choses not to use the FINOS provided Open Developer Platform (ODP), a comparable SDLC should be adopted and made available.

#150
Build & Release

The Project code/documentation release process automated or at lest well documented.

If code is published, publicly redistributed release binaries should be listed or referred to in the documentation (e.g. under the FINOS namespace in an artefact repository or package manager, e.g. NPM, Maven Central, etc.)

#151
Security
  • No OWASP Top 10 warnings are present in the code
  • No long-standing medium or higher vulnerabilities (2+ months) and proper security disclosure processes
  • Any cryptographic functions and key lengths used within the software should be identified and vetted with Foundation's legal counsel in order to request compliance with U.S. Export policy.
#152
Documentation

The README.md must include or reference up to date:

  • end user docs, including a description of the software, feature overview, installation & configuration instructions
  • developer docs, including links to other external systems (further docs, wiki, CI & validation tools, artefact repository, change log / history, etc.)
  • where possible badges (e.g. from shields.io) are encouraged
  • sample code explaining how to use the project, library, standard, SDK, etc.
#153
DIVERSITY & VIABILITY
Community Project has active participation from 2+ independent individuals and/or organizations; Ideally Project Team members who make contributions in connection with their employment are doing do as part of their regular job duties. #154
Project Team Project Team has/have demonstrated active involvement in PMC and have demonstrated commitment to furthering overall Program goals #155
License Project must not have dependencies which effectively restrict how the project may be distributed or deployed and must not depend on any proprietary third-party components for their core functionality. #156
Trademark Community is using a different established Project name or original contribution trademark is owned by FINOS. All Project related websites and assets are owned and hosted by FINOS. #157
ROADMAP & RESOURCES
Progress Project has progressed against its public roadmap during incubation; roadmap is aligned with, and where applicable incorporated into, the overall program roadmap or backlog #158
Versioning Project software is production grade and ready for large scale consumption. 1.0.0 version was released and announced it to the announce@ mailing list. #159
Roadmap Projects share and work to a public roadmap, aligned with the overall program roadmap. #160
FINOS Support Project Team is largely self-sufficient, requiring minimal operational support from FINOS to govern the maintain the project. FINOS support switches to strategic growth of the Project in the Community. #161
GROWTH & ADOPTION
Usefulness The Project demonstrably solves a real life use case in the Community. Evidence of adoption beyond the contributing individuals or firms (e.g., in the form of download statistics, listing known deployments or implementations, etc.) #162
Status Badging Project Team commits to adopt the FINOS Active badge in the README.md once PMC approves activation properly signal adopters the new state of the Project #163
HYGIENE & OPERATIONS
Compliance The appropriate license text is included in each source file's header. See details and template #164
Community Inquiries Community inquiries on the project channels (mailing lists, issues and pull requests, etc) are generally promptly answered #165
Meeting Hygiene If the project meets regularly on-line, the Project Team has demonstrated a track record of publishing and distributing agenda no less than 24 hours before the meeting, and publishes meeting minutes after calls. #166
Transparency Project Team has adopted a transparent governance model(*) consistent with FINOS Community governance. Work for new contributors is organized into issues within a public issue tracking system, as appropriate, tagged as "Good First Issues" #167

(*) transparent governance model is when a project’s discussions, minutes, deliberations, project plans, issue tracking plans for new features, and other artefacts are open, public, and easily accessible in the FINOS Project Infrastructure or FINOS sanctioned external system.

CVE-2018-16487 (High) detected in lodash-4.17.10.tgz

CVE-2018-16487 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/lodash/package.json

Dependency Hierarchy:

  • vsce-1.40.0.tgz (Root Library)
    • lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11

CVE-2018-20834 (High) detected in tar-2.2.1.tgz

CVE-2018-20834 - High Severity Vulnerability

Vulnerable Library - tar-2.2.1.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.1.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/tar/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • gulp-untar-0.0.6.tgz
      • tar-2.2.1.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).

Publish Date: 2019-04-30

URL: CVE-2018-20834

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/344595

Release Date: 2019-04-30

Fix Resolution: v4.4.2

FINOS Support

  • Project Team is largely self-sufficient, requiring minimal operational support from FINOS to govern the maintain the project. 
  • FINOS support switches to strategic growth of the Project in the Community.

Add Business Context of plexus-interop to README

Add business context -- i.e., what are the sorts of business problems that plexus-interop helps solves, to the top of the README.

"metadata-centric language-agnostic desktop app-to-app interoperability framework with extensible model for launching new instances of desktop Apps on demand." is descriptive but dense -- may be helpful to frame the usefulness of plexus-interop first in non-technical terms.

WS-2018-0076 (Medium) detected in tunnel-agent-0.4.3.tgz

WS-2018-0076 - Medium Severity Vulnerability

Vulnerable Library - tunnel-agent-0.4.3.tgz

HTTP proxy tunneling agent. Formerly part of mikeal/request, now a standalone module.

Library home page: https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.4.3.tgz

Path to dependency file: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/package.json

Path to vulnerable library: /tmp/ws-scm/plexus-interop/dsl/interop-lang-vscode/node_modules/tunnel-agent/package.json

Dependency Hierarchy:

  • vscode-1.1.14.tgz (Root Library)
    • gulp-remote-src-0.4.3.tgz
      • request-2.79.0.tgz
        • tunnel-agent-0.4.3.tgz (Vulnerable Library)

Found in HEAD commit: d9d610777e200bce5bd2af9d06959650b9b5a998

Vulnerability Details

Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.

Publish Date: 2018-04-25

URL: WS-2018-0076

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/598

Release Date: 2018-01-27

Fix Resolution: 0.6.0

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.