BlackDuck raises high security issue in libopen-pal.so.40.30.2 against libevent 2.0.21

[artemry-nv]

Background information

What version of Open MPI are you using? (e.g., v3.0.5, v4.0.2, git branch name and hash, etc.)

v4.1.x

BlackDuck raises high security issue in libopen-pal.so.40.30.2 against libevent 2.0.21. Maybe it should be updated to newer version?

[jsquyres]

See #10565 and #10542 -- a PR which back-ports the fixes (even though Open MPI doesn't use any of the CVE-affected code).

@artemry-nv A few questions for you:

1. This CVE is several years old. Do you know how/why it happened to come up now?
2. What version of libopen-pal.so.40.32.2 -- is that Open MPI v4.1.4?
3. Do you know how BlackDuck found this -- is it flagging the fact that Open MPI is linking against libevent 2.0.21? Or is it something deeper?

[artemry-nv]

See #10565 and #10542 -- a PR which back-ports the fixes (even though Open MPI doesn't use any of the CVE-affected code).

@artemry-nv A few questions for you:

1. This CVE is several years old. Do you know how/why it happened to come up now?
2. What version of libopen-pal.so.40.32.2 -- is that Open MPI v4.1.4?
3. Do you know how BlackDuck found this -- is it flagging the fact that Open MPI is linking against libevent 2.0.21? Or is it something deeper?

As far as I see the issue exists quite a long period (was ignored before).
We use Open MPI v4.1.x (1c67bf1).
Not sure how BlackDuck found this (suspect that it tries to find any versioning reference). If it's unable to find version it raises an issue and you need to specify version manually.

[jsquyres]

@artemry-nv What I'm trying to determine is whether PR #10565 will fix the issue. I.e., if we patch the existing Libevent 2.0.21 source code, will Black Duck still complain (because it's just looking at the Libevent version number, and not the actual source code)? Or is Black Duck looking at the source code, and it will see the patches, and therefore #10565 will resolve the issue.

Can you test applying the patches on #10565 and see if Black Duck still complains about the CVE?

Also, what is the urgency level of this for Nvidia? Per the discussion on #10565, the CVE does not affect Open MPI (because we don't use those parts of Libevent at all). Do you have customers complaining about this CVE? Or is this just something you happened to notice in a Black Duck report?

[artemry-nv]

@artemry-nv What I'm trying to determine is whether PR #10565 will fix the issue. I.e., if we patch the existing Libevent 2.0.21 source code, will Black Duck still complain (because it's just looking at the Libevent version number, and not the actual source code)? Or is Black Duck looking at the source code, and it will see the patches, and therefore #10565 will resolve the issue.

Can you test applying the patches on #10565 and see if Black Duck still complains about the CVE?

Also, what is the urgency level of this for Nvidia? Per the discussion on #10565, the CVE does not affect Open MPI (because we don't use those parts of Libevent at all). Do you have customers complaining about this CVE? Or is this just something you happened to notice in a Black Duck report?

We'll try the patch. I suspect BlackDuck just parses version info.
Regarding the urgency, taking into account it's quite old issue and the justification that known libevent CVE more likely doesn't impact Open MPI, so I'd say it isn't urgent.

[artemry-nv]

Checked BlackDuck details also:
libevent 2.0.21

Identifier	Overall Score	Status	CWE	Exploit	Workaround	Solution
	NVDCVE-2015-6525	7.5High	New	CWE-189	–	–
	NVDCVE-2014-6272	7.5High	New	CWE-189	–	–
	BDSABDSA-2017-2645(CVE-2016-10197)	4.8Medium	New	CWE-416		–
	BDSABDSA-2017-2642(CVE-2016-10196)	4.8Medium	New	CWE-121		–
	BDSABDSA-2017-2644(CVE-2016-10195)	4.8Medium	New	CWE-205		–

Short Term Upgrade Recommendation
[release-2.0.22-stable]
Has no known vulnerabilities
Long Term Upgrade Recommendation
[release-2.0.22-stable]
Has no known vulnerabilities

[jsquyres]

@artemry-nv Can you clarify your last comment -- does that mean you tried applying the patch and BlackDuck still reported the 5 CVEs?

[artemry-nv]

@artemry-nv Can you clarify your last comment -- does that mean you tried applying the patch and BlackDuck still reported the 5 CVEs?

Not yet tried, will try shortly.

[jsquyres]

Not yet tried, will try shortly.

@artemry-nv Ping. 😄

[jsquyres]

@janjust @artemry-nv Could really use an answer from NVIDIA here -- it's been almost 4 weeks.

[jsquyres]

@janjust @artemry-nv Hey NVIDIA. Can someone please reply? I've been asking for a reply since August 2. It's pretty rude to publicly post about a CVE and then not follow up about it.

[artemry-nv]

@janjust @artemry-nv Hey NVIDIA. Can someone please reply? I've been asking for a reply since August 2. It's pretty rude to publicly post about a CVE and then not follow up about it.

Hi Jeff,
Sorry for the delay. What is the actual version of the fix? PR #10602?