corda/.snyk

# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
version: v1.25.0
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
ignore:
  SNYK-JAVA-COMGOOGLEGUAVA-1015415:
    - '*':
        reason: >-
          Guava’s Files.createTempDir() is used during integration tests only.
          Users of Corda are advised not to use Guava’s Files.createTempDir()
          when building applications on Corda.
        expires: 2023-07-21T11:38:11.478Z
        created: 2022-12-29T11:38:11.489Z
  SNYK-JAVA-COMH2DATABASE-31685:
    - '*':
        reason: >-
          H2 console is not enabled for any of the applications we are running.

          When it comes to DB connectivity parameters, we do not allow changing 
          them as they are supplied by Corda Node configuration file.
        expires: 2023-07-21T11:39:26.763Z
        created: 2022-12-29T11:39:26.775Z
  SNYK-JAVA-COMH2DATABASE-2331071:
    - '*':
        reason: >-
          H2 console is not enabled for any of the applications we are running.

          When it comes to DB connectivity parameters, we do not allow changing 
          them as they are supplied by Corda Node configuration file.
        expires: 2023-07-21T11:41:05.707Z
        created: 2022-12-29T11:41:05.723Z
  SNYK-JAVA-COMSQUAREUPOKHTTP3-2958044:
    - '*':
        reason: >-
          The vulnerability in okhttp’s error handling is only exploitable in
          services that receive and parse HTTP requests. Corda does not receive
          HTTP requests and thus is not exposed to this issue.
        expires: 2023-07-21T11:42:55.546Z
        created: 2022-12-29T11:42:55.556Z
  SNYK-JAVA-IONETTY-1042268:
    - '*':
        reason: >-
          Corda does not rely on hostname verification in the P2P protocol to
          identify a host, so is not impacted by this vulnerability. Corda uses
          its own SSL identity check logic for the network model. Corda
          validates based on the full X500 subject name and the fact that P2P
          links use mutually authenticated TLS with the same trust roots. For
          RPC SSL client connections Artemis is used which calls into netty. The
          default value for verifyHost is true for Artemis client connectors so
          verification of the host name in netty does occur.
        expires: 2023-07-21T11:45:42.976Z
        created: 2022-12-29T11:45:42.981Z
  SNYK-JAVA-ORGJETBRAINSKOTLIN-2628385:
    - '*':
        reason: >-
          This is a build time vulnerability. It relates to the inability to
          lock dependencies for Kotlin Multiplatform Gradle Projects. At build
          time for Corda we do not use Multiplatform Gradle Projects so are not
          affected by this vulnerability. In addition as it is a build time
          vulnerability released artifacts are not affected.
        expires: 2023-07-21T11:52:35.855Z
        created: 2022-12-29T11:52:35.870Z
  SNYK-JAVA-ORGJETBRAINSKOTLIN-2393744:
    - '*':
        reason: >-
          This vulnerability relates to information exposure via creation of
          temporary files (via Kotlin functions) with insecure permissions.
          Corda does not use any of the vulnerable functions so it not
          susceptible to this vulnerability.
        expires: 2023-07-21T13:39:03.244Z
        created: 2022-12-29T13:39:03.262Z
  SNYK-JAVA-ORGYAML-3016888:
    - '*':
        reason: >-
          Snakeyaml is being used by Jackson and liquidbase. Corda does not use
          Jackson for deserialization except in the optional shell which we
          recommend using standalone. The Corda node itself is not exposed.
          Corda does however provide mappings of Corda types to allow CorDapps
          to use Jackson, and CorDapps using Jackson should make their own
          assessment. Liquibase is used to apply the database migration changes.
          XML files are used here to define the changes not YAML and therefore
          the Corda node itself is not exposed to this deserialisation
          vulnerability.
        expires: 2023-07-21T13:39:49.450Z
        created: 2022-12-29T13:39:49.470Z
  SNYK-JAVA-ORGYAML-2806360:
    - '*':
        reason: >-
          Snakeyaml is being used by Jackson and liquidbase. Corda does not use
          Jackson except in the optional shell which we recommend using
          standalone. The Corda node itself is not exposed. Corda does however
          provide mappings of Corda types to allow CorDapps to use Jackson, and
          CorDapps using Jackson should make their own assessment. Liquibase is
          used to apply the database migration changes. XML files are used here
          to define the changes not YAML and therefore the Corda node itself is
          not exposed to this DOS vulnerability.
        expires: 2023-07-21T13:40:55.262Z
        created: 2022-12-29T13:40:55.279Z
  SNYK-JAVA-ORGLIQUIBASE-2419059:
    - '*':
        reason: >-
          This component is used to upgrade the node database schema either at
          node startup or via the database migration tool. The XML input for the
          database migration is generated by Corda from either R3 supplied XML
          files included in corda.jar or those XML files written by the CorDapp
          author included in a CorDapp that is installed in the node CorDapps
          directory. Contract CorDapps received over the network are not a
          source of XML files for this generation step.  An attacker trying to
          exploit this vulnerability would need access to the server with the
          XML input files, and specifically the access and ability to change JAR
          files on the file system that make up the Corda installation.
        expires: 2023-07-21T13:42:11.552Z
        created: 2022-12-29T13:42:11.570Z
  SNYK-JAVA-ORGYAML-3113851:
    - '*':
        reason: >-
          Snakeyaml is being used by Jackson and liquidbase. Corda does not use
          Jackson for deserialization except in the optional shell which we
          recommend using standalone. The Corda node itself is not exposed.
          Corda does however provide mappings of Corda types to allow CorDapps
          to use Jackson, and CorDapps using Jackson should make their own
          assessment. Liquibase is used to apply the database migration changes.
          XML files are used here to define the changes not YAML and therefore
          the Corda node itself is not exposed to this deserialisation
          vulnerability.
        expires: 2024-04-30T00:00:00.000Z
        created: 2022-12-29T14:55:03.623Z
  SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038426:
    - '*':
        reason: >-
          Corda does not use Jackson for deserialization except in the optional
          shell which we recommend using standalone. The Corda node itself is
          not exposed. Corda does however provide mappings of Corda types to
          allow CorDapps to use Jackson, and CorDapps using Jackson should make
          their own assessment. This vulnerability relates to deeply nested
          untyped Object or Array values (3000 levels deep). Only CorDapps with
          these types at this level of nesting are potentially susceptible.
        expires: 2023-07-12T16:50:57.921Z
        created: 2022-12-29T16:50:57.943Z
  SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038424:
    - '*':
        reason: >-
          Corda does not use Jackson for deserialization except in the optional
          shell which we recommend using standalone. The Corda node itself is
          not exposed. Corda does however provide mappings of Corda types to
          allow CorDapps to use Jackson, and CorDapps using Jackson should make
          their own assessment. This vulnerability relates to deeply nested
          untyped Object or Array values (3000 levels deep). Only CorDapps with
          these types at this level of nesting are potentially susceptible.
        expires: 2023-07-12T16:52:30.722Z
        created: 2022-12-29T16:52:30.747Z
  SNYK-JAVA-ORGYAML-3016891:
    - '*':
        reason: >-
          Snakeyaml is being used by Jackson and liquidbase. Corda does not use
          Jackson for deserialization except in the optional shell which we
          recommend using standalone. The Corda node itself is not exposed.
          Corda does however provide mappings of Corda types to allow CorDapps
          to use Jackson, and CorDapps using Jackson should make their own
          assessment. Liquibase is used to apply the database migration changes.
          XML files are used here to define the changes not YAML and therefore
          the Corda node itself is not exposed to this deserialisation
          vulnerability.
        expires: 2023-07-12T17:00:51.957Z
        created: 2022-12-29T17:00:51.970Z
  SNYK-JAVA-ORGYAML-3016889:
    - '*':
        reason: >-
          Snakeyaml is being used by Jackson and liquidbase. Corda does not use
          Jackson for deserialization except in the optional shell which we
          recommend using standalone. The Corda node itself is not exposed.
          Corda does however provide mappings of Corda types to allow CorDapps
          to use Jackson, and CorDapps using Jackson should make their own
          assessment. Liquibase is used to apply the database migration changes.
          XML files are used here to define the changes not YAML and therefore
          the Corda node itself is not exposed to this deserialisation
          vulnerability.
        expires: 2023-07-12T17:02:02.538Z
        created: 2022-12-29T17:02:02.564Z
  SNYK-JAVA-COMH2DATABASE-2348247:
    - '*':
        reason: >-
          H2 console is not enabled for any of the applications we are running.
          When it comes to DB connectivity parameters, we do not allow changing
          them as they are supplied by Corda Node configuration file.
        expires: 2023-07-28T11:36:39.068Z
        created: 2022-12-29T11:36:39.089Z
  SNYK-JAVA-COMH2DATABASE-1769238:
    - '*':
        reason: >-
          H2 is not invoked by Corda unless the node deployment configures an H2
          database.  This is not a supported configuration in Production and so
          this vulnerability should be irrelevant except during development on
          Corda. Corda itself does not store XML data within the database so
          Corda is not susceptible to this vulnerability. If CorDapp developers
          store XML data to the database they need to ascertain themselves that
          they are not susceptible.
        expires: 2023-07-28T11:40:29.871Z
        created: 2022-12-29T11:40:29.896Z
  SNYK-JAVA-ORGYAML-3152153:
    - '*':
        reason: >-
          There is a transitive dependency on snakeyaml from the third party
          components jackson-dataformat-yaml and liquidbase-core. The
          jackson-dataformat-yaml component does not use the snakeyaml
          databinding layer. For liquidbase we use xml in the changelog files
          not yaml. So given this Corda is not susceptible to this
          vulnerability.Cordapp authors should exercise their own judgment if
          using this library directly in their cordapp.
        expires: 2023-07-03T11:35:04.385Z
        created: 2023-01-04T11:35:04.414Z
  SNYK-JAVA-IONETTY-3167773:
    - '*':
        reason: >-
          Corda does not use Netty HTTP (and does not use HTTP in the P2P
          protocol) . This is a transitive dependency of Netty comms library,
          but it is not used in Corda, which uses a custom binary protocol
          secured by mutually authenticated TLS. The vulnerability relating to
          HTTP Response splitting is not exposed.
        expires: 2023-07-03T11:40:51.456Z
        created: 2023-01-04T11:40:51.467Z
  SNYK-JAVA-COMH2DATABASE-3146851:
    - '*':
        reason: >-
          Corda does not make use of the H2 web admin console, so it not
          susceptible to this reported vulnerability
        expires: 2023-07-03T11:45:11.295Z
        created: 2023-01-04T11:45:11.322Z
patch: {}