https://cfml.slack.com/archives/C06TABBT8/p1689358312198449?thread_ts=1689357232.046549&cid=C06TABBT8 @Dave Merrill https://www.codersrevolution.com/blog/whos-had-more-vulns-php-java-or-coldfusion https://www.codersrevolution.com/blog/whos-had-more-vulns-redux-php-java-coldfusion-ror-or-net https://www.codersrevolution.com/blog/whos-had-more-vulns-take-3-java-coldfusion-ror-net

I wonder how these numbers would look if weighted according to the number of sites powered by each tech? It would also be interesting to know how many vulns were actually exploited due to unpatched servers? We seem to hear a lot of people here still running old versions on old JVMs - but is that any worse than the average out there? I liked your analysis of Adobe's very conservative rating of vulns - "everything's a ten!"😁

Breakdown of non admin CVEs would also be interesting

I've been curious about this since reading these... Since cf runs on top of java and tomcat, does that inherently make every java and tomcat cve also one that affects coldfusion? So while not an issue with cf itself, if you're running python, or php, or .net, (as a more "standalone" platform) does that inherently lower the numbers? ie. .net is 10. Cf is 8 + 10 + 64 = 82...

@Tim yeah, pretty much. I just looked at the snyk report for a baseline CF2023 image (using Adobe's official image), and a PHP 8.2 one. CF2023: 27C 51H 28M 19L PHP: 0C 0H 0M 58L (Critical / High / Medium / Low) Obvs these are based on Docker images, so will include OS level issues as well as platform and language ones. However a vuln is still a vuln. One might contend "but Java vuln x is not exposed by CF". One can't think like that. PHP vuln y might not be exposed by my app either! InfoSec bods can't care (I mean: professionally they mustn't) whether or not something is immediately or obviously exploitable: what matters is a vuln has been identified, and we're running software that includes that vuln. Given CF2023 is fresh out of the gate, it's pretty bloody bad that the official Adobe image has so many vulns. ping @Mark Takata (Adobe) on that one.

Just scanned our acf 2018u17 / acf 2023u1 command box docker images (slight tweaks from the base ortus versions but nothing to alter the CVE’s) with snyk and both came back with 0C 0H 5M 19L So looks like the base image Adobe uses is full of holes 🧀

I'd be very interested to know the differences in the Ortus vs Adobe images that could cause such a difference in vulnerabilities??

@jclausen may have a view on this, ortus have a few variations, alpine, ubuntu (I think) and red hat universal base image - my numbers were from the “normal” version which is the ubuntu one

I’ve reported those scan results to Adobe multiple times and have tried to be a squeaky wheel about them. I know @Mark Takata (Adobe) has been trying to light a fire under the dev teams to get them resolved, with mixed results.

Oh and they - Jon and the gang - pay attention to this kind of stuff which a GREATLY appreciated

I can share that we are working on getting these resolved Jon. There's an update coming that updates a lot of them. I don't have a list yet, because we're trying to get as many out as possible. But your voice has been moving mountains, please keep it up Jon.

Interestingly the scan I did was on pre-warmed images (base command box 3.7.8) and I run warmup myself as part of the build - the snyk scan via the docker extension didn’t seem to notice the adobe cve’s in the image. Neither does AWS ECR, so not sure how deep they are scanning

That’s why I prefer

grype

to scan java - because it will recurse in to the jars and look at all of the manifests.

sounds like a quick Adobe win would be to run “yum update” on their images at the very least 🙂

Doug, I have not seen whether that will be the case. Are you looking to run production workloads on a particular set of ARM architecture? I know that @paul got CF running on some of the AWS ARM chips a while back through his particular magic.

We run commandbox arm images for for dev (macs) and production AWS fargate using ACF already - just seems like an obvious omission in the official images.