Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1 test inside when the testitem.path field is exceeded the allowable "ltree" field type indexing limit (path length=120 approximately, recursive nesting of the nested steps). REINDEX INDEX pathgistidx and pathidx aren't helped. Patches The problem was fixed in service-api module of version 5.10.0 (product release 23.2), where the maximum number of nested elements were programmatically limited. Workarounds After deletion of the data with long paths, and reindexing both indexes (pathgistidx and pathidx), the database becomes stable and ReportPortal is working properly.
Recommended action: Upgrade to 5.10.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was discovered in service-api before 4.3.12 and 5.x before 5.1.1 for Report Portal. It allows XXE, with resultant secrets disclosure and SSRF, via JUnit XML launch import.
Recommended action: Upgrade to 5.1.1 or 4.3.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
| Release Date | Affected Projects | Affected Versions | Access Vector| Security Risk | |--------------|-------------------|-------------------|---------------|---------------| | Monday, May 4, 2020| service-api | Every version, starting from 3.1.0 | Remote | Medium | Impact Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file that uses external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. Report Portal versions 4.3.12+ and 5.1.1+ disables external entity resolution for theirs XML parser. We advise our users install the latest releases we built specifically to address this issue. Patches Fixed with https://github.com/reportportal/service-api/pull/1201 Binary Download https://bintray.com/epam/reportportal/service-api/5.1.1…
Recommended action: Upgrade to 5.1.1 or 4.3.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery. Patches Fixed with: https://github.com/reportportal/service-api/pull/1392 Binaries docker pull reportportal/service-api:5.4.0 https://github.com/reportportal/service-api/packages/846871?version=5.4.0 For more information If you have any questions or comments about this advisory email us: support@reportportal.io
Recommended action: Upgrade to 5.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.