Security Vulnerabilities Application: how to read it

Help / Discuss
1

Hi.

We use https://extensions.xwiki.org/xwiki/bin/view/Extension/Extension/Security/UI. We installed 15.10.13 and have nothing listed under “Extension Vulnerabilities” (a) but 10 entries under “Environment Vulnerabilities” (b). And then there is this message after clicking the notifications bell mentioning 1 extension with know vulnerability (c).

This is what I think I understood:
c)
[The number in the notifications] “is actually the number of vulnerabilities which don’t have an explanation to suggest XWiki is not actually impacted (so kind of unknown known vulnerabilities, “known” in this context just referring to the fact that they are public in the database of CVEs, but we sometimes don’t know about them ourselves yet).”
So currently I can’t do (or must not do) anything right?

a)
If there would be some entry I can update those extensions within the extension manager, if an update is provided. Will there be an entry if no update is available too? (So maybe I can de-install it necessary?)

b)
In 15.10.11 there were 12 entries with 15.10.13 there are now 10. (These 10 were already listed in 15.10.11.) Can I do something? (I don’t think so.)

Regards, Simpel

2

In short, if it’s in “Environment Vulnerabilities” there is generally not much else you can do than upgrading XWiki to a more recent version because most of those vulnerabilities are in the XWiki WAR. Of course, theoretically you could try to upgrade some of those vulnerable dependencies in the WAR, and for some it’s easy (upgrading any Apache commons-* JAR is usually easy). But, often, upgrading one thing means also upgrading a bunch of other stuff it depends on and, in the worst case, may require modifying some code in XWiki because some API was broken/modified.

1 Like