Skip to content

How to fix security vulnerabilities?(Decommissioned)

security_vulnerabilities_1.png

Note: Generally speaking, when GSS has security issues, gss-devops will receive email reminders from ciam-support. (like the screenshot above) Then you can follow these steps below to solve.

File a CDETS

  1. Click the alert link in the email attachment, and find GSS, click 'Project Id' of GSS

security_vulnerabilities_2.png

2. You can file a CDETS for this issue. you can refer to https://cdetsng.cisco.com/webui/#view=CSCvv39895 or others. (Project: CSC.csg, Product: gss)

Backend Change

  1. Generally speaking, we need to update the version of the backend package. For example, in this example, we need to update the version of dom4j.

  2. We can find this package in backend pom.xml file and update the package version following the alert instruction. (Usually need to update to the latest version)
    security_vulnerabilities_3.png

  3. We need to ensure the normal build of the backend project, and push to stage and prod.

IPCentral Change

  1. Open IpCentral: https://ipcentral.cisco.com/ipcentral/jsp/ipcentral.jsp, click 'My Projects', double click 'Global Service Status' and we can enter into 'Project Details' page.

  2. Remove the old package in IPCentral-Project Details, and click 'Edit'

security_vulnerabilities_4.png

3. click 'Show Advanced Fields'

security_vulnerabilities_5.png

4. We can focus on 'Include Assets', and select to show 50 packages in one page

security_vulnerabilities_6.png

5. Find the package we want to update, and remove it by unselecting it and clicking 'update' . Of course we need to upload the updated version of the package.

security_vulnerabilities_7.png

6. We can check if the package version exists in 'Open Source Assets'. (Note: requested and Affirmed are available. INFO_REG isn't available.) If it exists, please skip to step 9. If it does not exist, continue to the next step.

security_vulnerabilities_8.png

7. Find the package with latest version in maven repo, and download the jar package

security_vulnerabilities_9.png

8. create a new component: fill the component information and upload the jar package(step 6), click 'Create'

security_vulnerabilities_10.png

security_vulnerabilities_11.png

9. We can check the component just created in 'Open Source Assets', and click 'Review request' if 'Review State' is 'new'. Then 'Review State' will change to 'Requested'(it's available).

security_vulnerabilities_12.png

10. Click 'Add to Project', select GSS project and click 'Add to selected project'

security_vulnerabilities_13.png

security_vulnerabilities_14.png

11. We can verify if the package exists in 'Include Assets'(Mentioned in step 3)

security_vulnerabilities_15.png

Update CDETS Status

We should update CDETS status to 'resolved'. (it's filed in File a CDETS above)

security_vulnerabilities_16.png