Security Vulnerability Identified in software.amazon:flow:1.7 Dependency

[SamBumgardner]

Running DependencyCheck on a project mid-migration to software.amazon.awssdk:sns:2.5.29 revealed a possible vulnerability:

The dependency software.amazon:flow:1.7 contains CVE-2018-13525

I don't have a good idea of how to tell if it's a false positive or not, since I don't have a clear idea of how it's being used behind-the-scenes.

Please let me know if there's any further investigation I can do to help dig up more information on this issue.

[varunnvs92]

The flow library is a copy of aws-eventstream-java repo and is included along with the SDK before the other repo was open sourced. We have plans to remove flow from our repo and add a dependency on the other library.

Can you run the check on eventstream library and cut a ticket there if vulnerability still exists?
Github repo: https://github.com/awslabs/aws-eventstream-java
Maven artifact: https://mvnrepository.com/artifact/software.amazon.eventstream/eventstream/1.0.0

[SamBumgardner]

Thanks for the info. I confirmed that aws-eventstream-java is vulnerability free!

My team would like to put off migrating to v2 until this vulnerability is resolved - could we use this ticket (or a new one) to track the switch from flow to aws-eventstream-java?

[varunnvs92]

Sure, we will use this for tracking.

[varunnvs92]

After discussing with the team, I am not sure if we are actually effected. The CVE says The mintToken function of a smart contract implementation for Flow,. The flow library we use don't have a mintToken function unless I missed something. Can you clarify the vulnerability?

[SamBumgardner]

I was confused by that too - it seems like a strange thing to have hanging out in the flow dependency. I don't have much visibility into the library, though, so I don't have a reliable way to tell if it's a false positive or not.

If your team agrees that its a false positive, that would be great news for us. I wanted to raise the issue in the first place because I don't have a good idea of what's actually going on in the potentially vulnerable dependency.

[varunnvs92]

We think its a false positive as the flow library is just a clone of aws-eventstream-java (before it went open source). Anyways we will schedule the work to move to aws-eventstream-java as customers can get better support from the owning team.

[dagnir]

Closing this as it was a false positive. The move to the eventstream library can be tracked in the PR: #1220