Apply Patching on TestNG Older version (supports JDK8) to mitigate CVE-2022-4065

[kamal-kaur04]

Hello,

I'm reaching out here to know that if there is a way to apply the patch (released with version 7.7.0 for vulnerability) to older TestNG Version (v7.5) which supports JDK8 as I currently compile my project with JDK8, so can't bump the version to LTS. Currently, the vulnerability is reflecting on https://mvnrepository.com/ on our package.

Thanks.

[krmahadevan]

@kamal-kaur04 - There are no plans for this from the TestNG team. We would encourage you to upgrade to the latest released version 7.7.1 which fixes that vulnerability

[prashil-g]

what about project which cant upgrade to 7.7.1 because they use jdk8. Can we upgrade to 7.7.1 even though we use jdk8?

[krmahadevan]

@prashil-g 7.5 is the last version that runs on JDK8. I totally understand the predicament.

It would be really great if you can upgrade. If not you can build and publish 7.5 patched version into your intranet.

Alternatively you could also propose a PR that patches and we can see how we can have it released ( this is also just a suggestion. I dont know what all is needed to be changed in our CI to accommodate this )

[prashil-g]

Hi @krmahadevan thanks for prompt response, appreciate it ! :)

I've cherry-picked the changes in my branch https://github.com/prashil-g/testng/tree/testng-7.5_zip-slip-vulnerability. Can you please create a branch out of 7.5 tag so I can raise a PR?

patch: https://github.com/cbeust/testng/compare/7.5...prashil-g:testng-7.5_zip-slip-vulnerability?expand=1

[krmahadevan]

@prashil-g - Here you go https://github.com/cbeust/testng/tree/release_7.5

[prashil-g]

Thanks @krmahadevan created #2899 . please let me know if anything else needed from my side! :)

[krmahadevan]

@prashil-g - I would still need to figure out how to get the release process sorted out. It will take sometime. Please bear with me on that.

[prashil-g]

Sure @krmahadevan I will wait. Really appreciate your help 👍

[kamal-kaur04]

Thanks @krmahadevan, Let me know if something needed from our side.

[krmahadevan]

@kamal-kaur04 - The fix is released into Maven central. Here's the release announcement https://groups.google.com/g/testng-users/c/71NlECG4AZ0/m/k64pMoFSAwAJ

[kamal-kaur04]

I can see new version got plublished. Thanks a lot @prashil-g for creating PR and @krmahadevan for releasing the version. I will give it a try.

[prashil-g]

Hi @krmahadevan I see that 7.5.1 is now showing on maven but it's still marked as vulnerable. can you help mark CVE fix versions to include 7.5.1?
https://mvnrepository.com/artifact/org.testng/testng/7.5.1

[krmahadevan]

@prashil-g -

can you help mark CVE fix versions to include 7.5.1?

Would you know how to get that done ?

@JLLeitschuh - Any pointers on how we can get this sorted out? Basically we back ported your PR #2806 and released it as 7.5.1 so that our JDK8 users can also help move away from this vulnerability.

[JLLeitschuh]

You're going to need to reach out to the CVE Numbering Authority (CNA) that issued the CVE to request that they update the CVE number.

You can find out who the CNA is by checking the "source" field on the CVE listing, which can be found at the bottom of this page.

https://nvd.nist.gov/vuln/detail/CVE-2022-4065

In this case the CNA is VulDB. You can find their contact information by searching the MITRE CVE site.

https://www.cve.org/PartnerInformation/ListofPartners

For VulDB, you can find their contact information here:

https://www.cve.org/PartnerInformation/ListofPartners/partner/VulDB

[krmahadevan]

@JLLeitschuh - Thank you so much for sharing all that context. I have reached out to VulDB folks on the email that is listed.

[JLLeitschuh]

Perfect! Happy to help! I figured a show-and-tell model would be helpful for if this comes up for you with other potential vulnerability in the future 🙂

[prashil-g]

@krmahadevan Did you hear back from VulDB. 7.5.1 is still flagged wrongly for CVE

[krmahadevan]

@prashil-g

Below is the response from VulDB folks

Great! We have just updated our entry: https://vuldb.com/?diff.214027
And also synced this new information with the CVE program: https://www.cve.org/CVERecord?id=CVE-2022-4065

We don't know what and how mvnrepository syncs vulnerability
information. We assume they are using the CPE values of CVE entries. In
this case this should also address their listing. If not, please contact
them directly and ask them to update their data as well.

If there is anything else, please let us know.

Regards,

VulDB CNA Team
https://vuldb.com/

I have reached out to info@mvnrepository.com on April 29, sharing this information and asking them to update things at their end.

Unfortunately I have not heard back from the folks at mvnrepository.com

[JLLeitschuh]

I haven't gotten responses from mvnrepository.com when I've reached out in the past

[krmahadevan]

@prashil-g - Looks like mvnrepository has gotten updated

[prashil-g]

@krmahadevan That's great news. I've written to synk.io update their DB to reflect testng 7.5.1 is not vulnerable:.
https://security.snyk.io/package/maven/org.testng:testng/7.5