Known issues

Important:

Always feel free to raise an issue on the help desk.

Security issues

Severity Levels

Punchplatform security advisories include a severity level. This severity level is based on our self-appreciation for each specific vulnerability for the Punchplatform product.

• Critical
• High
• Medium
• Low

Severity Level: Critical

Vulnerabilities that score in the critical range usually have most of the following characteristics:

• Exploitation of the vulnerability likely results in root-level compromise of servers or infrastructure devices.
• Exploitation is usually straightforward, in the sense that the attacker does not need any special authentication credentials.

For critical vulnerabilities, is advised that you patch or upgrade as soon as possible, unless you have other mitigating measures in place.

For example, a mitigating factor could be if your installation is not accessible from the Internet.

Severity Level: High

Vulnerabilities that score in the high range usually have some of the following characteristics:

• The vulnerability is difficult to exploit.
• Exploitation could result in elevated privileges.
• Exploitation could result in a significant data loss or downtime.

Severity Level: Medium

Vulnerabilities that score in the medium range usually have some of the following characteristics:

• Vulnerabilities where exploitation provides only very limited access.
• Vulnerabilities that require user privileges for successful exploitation.

Severity Level: Low

Vulnerabilities in the low range typically have very little impact on an platform’s business. Exploitation of such vulnerabilities usually requires local or physical system access.

Announced Vulnerabilities

Functionnal Issues

Known Bugs

Mitigations

CVE-2021-44228

Last update 2022/01/10 :  correction on Facing permission issues (replacing chmod by chown). 

Update 2022/01/03 : Following returns from our customers, we detect permissions issues when applying the mitigation published on  2021/12/15. 

Initial published date 2021/12/15.

remove JndiLookup.class

The following ansible command allows you to remove all org/apache/logging/log4j/core/lookup/JndiLookup.class from the punchplatform’s jar. 

ansible -m  shell -a 'for file in $(find <punchplatform-setups_root> -name *.jar); do zip -sf $file | grep org/apache/logging/log4j/core/lookup/JndiLookup.class; if [ $? -eq 0 ]; then echo found in $file; zip -q -d $file org/apache/logging/log4j/core/lookup/JndiLookup.class; fi; done' -u <deploy-user> --become-user <punchplatform-daemon-user> -i <servers-inventory> <pattern-server> -b 

where:

• • <punchplatform-setups_root> is defined by the setting setups_root of your punchplatform-deployment.settings
  • <deploy-user> is a user with sufficient access to the setups_root directory and sub directories
  • <punchplatform-daemon-user> is the user as defined in punchplatform-deployment.settings by  platform.punchplatform_daemons_user
  • <pattern-server> is a pattern matching all the servers of the punchplatform.
  • <servers-inventory> is the inventory available in your deployer node at $PUNCHPLATFORM_CONF_DIR/generated_inventory/current-deployment.inv

Restart the impacted services

Restart services of the following cots:

• • elasticsearch

  • shiva

  • storm

  • Punch-gateway

Facing permission issues?

If you applied the mitigation before the update of the 2022/01/03 you might face issues to restart your application. It comes from a permission issue. The previous command changes the user of the modified jars to root. The following command allows you to set the good owner and group:

ansible -m  shell -a 'for file in $(find <punchplatform-setups_root> -name *.jar -user root); do echo changing owner of $file; chown <punchplatform-daemon-user>:<punchplatform-daemon-user> $file; done' -u <deploy-user> -i <servers-inventory> <pattern-server> -b

#1630

Add the  "enable.auto.commit": false setting in the settings section of all your kafka input nodes. You can confirm that this setting is in effect by reading the settings applied by the consumer, at the start of the storm/shiva worker task logs.