<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hello everyone,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Our policy for reporting security issues is at <a href="https://github.com/archivesspace/archivesspace/blob/master/SECURITY.md">
archivesspace/SECURITY.md at master · archivesspace/archivesspace</a> . Given the sensitivity, we maintain security issues in a non-public JIRA. When you encounter issues locally, please do reach out to us at
<a href="mailto:ArchivesSpaceHome@lyrasis.org">ArchivesSpaceHome@lyrasis.org</a> first so that we can discuss it with you.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We’re currently investigating this issue. ArchivesSpace has many dependencies built into it, which can make upgrading individual pieces more complex than it might otherwise be. The timing for upgrades is always dependent on matching our
available resources with the community's highest priorities, while taking care of infrastructure items and dependencies with the highest urgency as quickly as possible. Jetty is used in a relatively limited way in ArchivesSpace, as it is not the primary web
server for most people using the application, which has, in the past, made upgrading it less time sensitive than it might otherwise be. We will review all new information, however, to determine if circumstances have changed. We’ll have an update on this soon.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Christine<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#1F497D">Christine Di Bella<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#1F497D">ArchivesSpace Program Manager<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#1F497D"><a href="mailto:christine.dibella@lyrasis.org">christine.dibella@lyrasis.org</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#1F497D">800.999.8558 x2905<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#1F497D">678-235-2905<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><img border="0" width="267" height="61" style="width:2.7777in;height:.6388in" id="Picture_x0020_1" src="cid:image001.jpg@01D7CB4C.3FFA24B0" alt="ASpaceOrgHomeMedium"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:0in;line-height:15.0pt;background:white;vertical-align:baseline">
<span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#2F3941"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> archivesspace_users_group-bounces@lyralists.lyrasis.org <archivesspace_users_group-bounces@lyralists.lyrasis.org>
<b>On Behalf Of </b>Shalvi, Doron (NIH/NLM) [C]<br>
<b>Sent:</b> Monday, October 25, 2021 11:14 AM<br>
<b>To:</b> archivesspace_users_group@lyralists.lyrasis.org<br>
<b>Subject:</b> [Archivesspace_Users_Group] Jetty out of date - critical vulnerability<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I wanted to pass on to the community some critical security vulnerabilities that we recently found when scanning our ArchivesSpace instance. These vulnerabilities allows authorization to be bypassed, due to the out of date version of Jetty
delivered with the system. I’ve written up these issues as a JIRA ticket at: <a href="https://archivesspace.atlassian.net/browse/ANW-1437">
https://archivesspace.atlassian.net/browse/ANW-1437</a>, but also wanted to post about the issue here to allow for discussion.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We are hoping to soon open our ArchivesSpace instance to the general public. Our security team will not allow ArchivesSpace to be opened to the public while it has a critical security vulnerability.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We are running ArchivesSpace 2.8.1, which uses Jetty 8.1.5. However, since all recent versions of ArchivesSpace use the same version of Jetty, I assume that all recent versions of ArchivesSpace are affected as well, including recent version
3.1. Version 8 of Jetty is considered “venerable” (older even than deprecated), as noted at
<a href="https://www.eclipse.org/jetty/download.php">https://www.eclipse.org/jetty/download.php</a> . With this version of Jetty, NetSparker noted 2 critical issues, 3 high issues, 1 medium issue, and 1 low issue.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">These issues were found by NetSparker, which is one of the security tools we use for scanning. Interestingly, this issue was found by NetSparker only a few weeks ago, and not in our previous NetSparker scans, even though our ArchivesSpace
instance has not changed. This implies that the issue was just recently added to NetSparker’s vulnerability database, may become more well-known, and could present an issue to other organizations using ArchivesSpace as well.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I understand that ArchivesSpace does not heavily use Jetty, and does not serve any static content using Jetty. However, Jetty can still be exploited even if it is behind an intermediary, such as Apache, as described in the links in the
ticket. We have spent a little bit of time attempting to upgrade Jetty on our own. We were able to upgrade to Jetty 9.4, but this version is still vulnerable to the issues noted above. We weren’t able to upgrade to Jetty 10 or 11, both of which require
Java 11 – it looks like this may take some work.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Has anyone else observed these issue? Would anyone have suggestions for remediation?
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I think that the best approach would be to upgrade Jetty to version 10 or 11, in line with a move to Java 11.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks for your thoughts and consideration!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Doron Shalvi<o:p></o:p></p>
<p class="MsoNormal">System Engineer<o:p></o:p></p>
<p class="MsoNormal">National Library of Medicine<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>