What about security vulnarability tools scanning RHDG ports?

Solution Verified - Updated -

Issue

  • We run scanner to detect vulnerabilities which scan also the DG endpoints, should we avoid it?
  • Should it be avoided to run security scanner to detect vulnerability against Data Grid ports?
  • What to do if a security scanner detects a DG server is vulnerable?
  • We have several WARN and ERROR messages found in our logfile, what is the purpose or it? Here some examples
WARN  [org.infinispan.rest.Http20RequestHandler] (REST-ServerWorker-5-6) ISPN012006: Uncaught exception in the pipeline: java.lang.StringIndexOutOfBoundsException: String index out of range: -1
    at java.lang.String.substring(String.java:1931)
    at org.infinispan.rest.InfinispanRequestFactory.createRequest(InfinispanRequestFactory.java:35)
    at org.infinispan.rest.Http20RequestHandler.channelRead0(Http20RequestHandler.java:53)
    at org.infinispan.rest.Http11RequestHandler.channelRead0(Http11RequestHandler.java:35)
    at org.infinispan.rest.Http11RequestHandler.channelRead0(Http11RequestHandler.java:18)
    at io.netty.channel.SimpleChannelInboundHandler.channelRead(SimpleChannelInboundHandler.java:105)
    ...

ERROR [org.infinispan.server.memcached.MemcachedDecoder] (Memcached-ServerWorker-4-2) ISPN005003: Exception reported: org.infinispan.server.memcached.UnknownOperationException: Unknown operation: �\00�\�.6$4'  "׾�i��7#�'����ٮ�\00�\00\00\00\00\00\00\00\00\00\00
\00\00\00 \00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00"\00#\00
    at org.infinispan.server.memcached.MemcachedDecoder.toRequest(MemcachedDecoder.java:1076)
    at org.infinispan.server.memcached.MemcachedDecoder.readHeader(MemcachedDecoder.java:327)
    at org.infinispan.server.memcached.MemcachedDecoder.decodeHeader(MemcachedDecoder.java:207)
    at org.infinispan.server.memcached.MemcachedDecoder.decodeDispatch(MemcachedDecoder.java:185)
    at org.infinispan.server.memcached.MemcachedDecoder.decode(MemcachedDecoder.java:138)
    at io.netty.handler.codec.ReplayingDecoder.callDecode(ReplayingDecoder.java:367)
    ...

ERROR [org.infinispan.server.memcached.MemcachedDecoder] (Memcached-ServerWorker-4-3) ISPN005003: Exception reported: org.infinispan.server.memcached.UnknownOperationException: Unknown operation: \00�\00�\00\�.6$4'  "׾�i��7#�'����ٮ�\00�\00\00\00\00\00\00\00\00\00\00 \00\00\00  \00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00"\00#\00
    ...

2018-12-01 01:20:09,635 WARN  [org.infinispan.rest.Http20RequestHandler] (REST-ServerWorker-5-1) ISPN012006: Uncaught exception in the pipeline: java.lang.IllegalArgumentException: invalid escape sequence `%lo' at index 0 of: %login-config.xml

The new DG 7.3.6 cluster are crashing with this error:

2020-11-13 02:53:45,265 ERROR [org.infinispan.rest.Http20RequestHandler] (REST-ServerIO-5-14) ISPN012006: Uncaught exception in the pipeline: java.lang.IllegalArgumentException: unterminated escape sequence at index 0 of: %.
        at io.netty.handler.codec.http.QueryStringDecoder.decodeComponent(QueryStringDecoder.java:371)
        at io.netty.handler.codec.http.QueryStringDecoder.path(QueryStringDecoder.java:189)
        at org.infinispan.rest.InfinispanRequestFactory.createRequest(InfinispanRequestFactory.java:35)
        at org.infinispan.rest.Http20RequestHandler.channelRead0(Http20RequestHandler.java:54)
        at org.infinispan.rest.Http11RequestHandler.channelRead0(Http11RequestHandler.java:35)
        at org.infinispan.rest.Http11RequestHandler.channelRead0(Http11RequestHandler.java:18)
        at io.netty.channel.SimpleChannelInboundHandler.channelRead(SimpleChannelInboundHandler.java:99)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355)
        at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355)
        at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355)
        at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102)
        at io.netty.handler.codec.MessageToMessageCodec.channelRead(MessageToMessageCodec.java:111)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355)
        at org.infinispan.rest.cors.CorsHandler.channelRead(CorsHandler.java:75)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355)
        at io.netty.channel.CombinedChannelDuplexHandler$DelegatingChannelHandlerContext.fireChannelRead(CombinedChannelDuplexHandler.java:436)
        at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:321)
        at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:295)
        at io.netty.channel.CombinedChannelDuplexHandler.channelRead(CombinedChannelDuplexHandler.java:251)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355)
        at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:93)
        at org.infinispan.server.core.transport.StatsChannelHandler.channelRead(StatsChannelHandler.java:26)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355)
        at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)
        at io.netty.channel.epoll.AbstractEpollStreamChannel$EpollStreamUnsafe.epollInReady(AbstractEpollStreamChannel.java:792)
        at io.netty.channel.epoll.EpollEventLoop.processReady(EpollEventLoop.java:475)
        at io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:378)
        at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989)
        at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.lang.Thread.run(Thread.java:748)

Environment

  • Red Hat Data Grid (RHDG)
    • 7.x

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In