Skip to main content

Use of software with known vulnerabilities in development

Need​

Mitigation of software vulnerabilities in development environments

Context​

  • Usage of Scala 2.12.8 for building scalable and high-performance applications
  • Usage of JDBC for connecting and interacting with relational databases
  • Usage of Anorm for database access and query execution
  • Usage of Ehcache for in-memory caching in Java applications
  • Usage of ws for WebSocket communication
  • Usage of specs2 for writing and executing specifications and tests
  • Usage of play-json library for JSON parsing and serialization in Typesafe Play framework
  • Usage of Akka Actor for building concurrent and distributed applications
  • Usage of Akka Stream for building reactive and scalable streaming applications
  • Usage of play-slick for integrating Slick database library with Play Framework
  • Usage of play-slick-evolutions for managing database schema evolutions in Typesafe Play framework
  • Usage of Play Framework with Guice for dependency injection in Java development

Description​

Non compliant code​

name := "MyApplication"

version := "1.0"

scalaVersion := "2.12.8"

libraryDependencies ++= Seq(
  jdbc,
  anorm,
  ehcache,
  ws,
  specs2 % Test,
  "com.typesafe.play" %% "play-json" % "2.6.9",
  "com.typesafe.akka" %% "akka-actor" % "2.5.21",
  "com.typesafe.akka" %% "akka-stream" % "2.5.21",
  "com.typesafe.play" %% "play-slick" % "3.0.3",
  "com.typesafe.play" %% "play-slick-evolutions" % "3.0.3",
  "com.typesafe.play" %% "play-guice" % "2.6.20"
)

play.sbt.PlayImport.playScalaSettings

The above code is the build configuration for a Scala project using SBT (Simple Build Tool). The libraryDependencies section defines the libraries that this project depends on.

The problem with this code is that it uses outdated versions of libraries that have known vulnerabilities. For example, the version of the Play framework being used is 2.6.9, which has several known vulnerabilities that have been fixed in later versions.

In addition, the versions of the Akka actor and Akka stream libraries being used are 2.5.21, which also have known vulnerabilities. The same applies to the versions of the Play Slick, Play Slick Evolutions, and Play Guice libraries being used.

Using software with known vulnerabilities can lead to a variety of security issues, including but not limited to: unauthorized disclosure of information, unauthorized modification of data, and disruption of service. It's generally recommended to always use the latest versions of software libraries, as they usually include fixes for known vulnerabilities.

Steps​

  • Identify the software or dependencies with known vulnerabilities
  • Update the version of the software or dependency to a version that does not have known vulnerabilities
  • Ensure that the updated version is compatible with the current application
  • Test the application thoroughly to ensure that the update does not introduce any new issues

Compliant code​

name := "MyApplication"

version := "1.0"

scalaVersion := "2.13.6"

libraryDependencies ++= Seq(
  jdbc,
  anorm,
  ehcache,
  ws,
  specs2 % Test,
  "com.typesafe.play" %% "play-json" % "2.9.2",
  "com.typesafe.akka" %% "akka-actor" % "2.6.14",
  "com.typesafe.akka" %% "akka-stream" % "2.6.14",
  "com.typesafe.play" %% "play-slick" % "5.0.0",
  "com.typesafe.play" %% "play-slick-evolutions" % "5.0.0",
  "com.typesafe.play" %% "play-guice" % "2.8.8"
)

play.sbt.PlayImport.playScalaSettings

The original code was using outdated versions of several dependencies, including the Scala language itself, the Play framework, and Akka. These outdated versions had known vulnerabilities that could potentially be exploited.

The updated code now uses the latest versions of these dependencies, which have patched these vulnerabilities. Specifically, the Scala version has been updated from 2.12.8 to 2.13.6, the Play JSON library from 2.6.9 to 2.9.2, the Akka actor and stream libraries from 2.5.21 to 2.6.14, the Play Slick library from 3.0.3 to 5.0.0, and the Play Guice library from 2.6.20 to 2.8.8.

Before deploying these changes, it's important to thoroughly test the application to ensure that these updates do not introduce any new issues. This includes functional testing to verify that the application behaves as expected, as well as security testing to confirm that the known vulnerabilities have been effectively mitigated.

References​

Last updated on