Axis vulnerabilities

[eclipse-birt]

Axis vulnerabilities

[SteveSchafer-Innovent]

I think I'm going to try creating a new axis plugin in the common directory, similar to org.w3c.sac. I'll build axis.jar from the github repo and put it in a lib folder and export everything necessary in an OSGI manifest. So it will be pretty much the same as the current Orbit bundle except with a newer jar. If this works, an Orbit bundle could be created from it. It requires a committer to do that.

[wimjongman]

Steve, I am working on creating a new build (#640) from a target platform. The build already works. The test currently fails.

With this new build, we can provide bundles from maven central. [1]

[1] https://mvnrepository.com/search?q=axis

[SteveSchafer-Innovent]

Good to know, but the axis on maven central is from 2006. It's necessary to build from the source on github to get the vulnerability fixes.

[SteveSchafer-Innovent]

Closing because pull request has been merged.

[wimjongman]

Steve, I am going to revert this because we can pull axis from maven. Any objections?

[wimjongman]

We can't pull it. They don't create releases anymore.

[tsiddiq]

Hi Steve,
To incorporate the recent https://nvd.nist.gov/vuln/detail/CVE-2023-40743 fix here, I've tried to build the axis-rt-core.jar using maven and it got built fine using AdoptOpenJDK 1.8, but looking at your built axis jar's manifest file, it says JDK 11 and I've compared the content of my built jar file with yours, both have little bit differences as well in content.

So, do you remember how exactly did you build your axis-1.4.1-SNAPSHOT.jar at first place?

Kindly see my attached jar with CVE fix incorporated:
axis-rt-core-1.4.1-SNAPSHOT.jar.zip

It looks like that you had built using ant instead of maven. right?

[merks]

There are some pretty strange things in BIRT, particularly test selected projects:

Those should be replaced with proper dependencies rather than local copies. Orbit provides this version

https://repo1.maven.org/maven2/org/apache/axis/axis/1.4/

There's also this:

https://repo1.maven.org/maven2/axis/axis/1.4/

But these are very old and I don't see any newer versions.

Should there be some newer version available from Maven with fixes?

[tsiddiq]

Should there be some newer version available from Maven with fixes?

Ideally YES but since particularly this axis1 has been reached EOL so they are not building this component anymore. Having said that unfortunately I don't see any straight forward solution than building locally to replace this copy just to incorporate this CVE's fix.

Should I also create some issue here?

[merks]

An awful lot of old things depend on it. E.g., all this in SimRel:

I recently created this repository with bundles in source form for things that just aren't available with source on Maven central.

https://github.com/eclipse-orbit/orbit-legacy

We really don't want to be in the business of maintaining more and more source bundle ourselves. That being said, there are quite a few dependencies on org.apache.axis, including from the bundles already in this source repository.

https://github.com/eclipse-orbit/orbit-legacy/blob/86d45aa9c636a78cd6934f510e65c6b1a6aa2e5d/plugins/org.uddi4j/META-INF/MANIFEST.MF#L51-L54

I don't think it makes sense for BIRT to maintain its own copy of this (or any other 3rd party bundle).

Scanning my maven central index, this appears to be a newer version:

https://repo1.maven.org/maven2/org/apache/geronimo/bundles/axis/1.4_2/

Is it possible that this one is fixed? It's from 2011...

Failing that, I think such a problem should be addressed in Orbit so that it can be reused more broadly. As such, I opened this issue:

eclipse-orbit/orbit-simrel#16

Probably it's best to continue the discussion there.