[UIMA-5636] UIMA-DUCC: restrict JMX access when running with older java

• Type: Improvement
• Status: Closed
• Priority: Trivial
• Resolution: Fixed
• Fix Version/s: 2.2.2-Ducc
• Component/s: DUCC
• Assignee: Jaroslaw Cwiklik
• Reporter: Jaroslaw Cwiklik
• Created: 01/Nov/17 16:27
• Updated: 02/Nov/17 15:16
• Resolved: 02/Nov/17 15:16

Description

Older java contain JMX related security vulnerability as described by CVE-2016-3427. DUCC processes run with JMX enabled by default and the java vulnerability can be exploited.
The main fix is to run with a newer java. These are the versions of java that contain the fix:

IBM - 1.7.0.9.40, 1.7.1.3_40, 1.8.0.3.0
Oracle (Sun) - 1.7.0_101+, 1.8.0_91+
Java 9 (Oracle & IBM)

Ducc code should introspect java version at runtime and lock down JMX when running with a version that is known to have the vulnerability. External JMX access should not be allowed.