What about security vulnarability tools scanning RHDG ports?

Solution Verified - Updated -

Issue

  • We run scanner to detect vulnerabilities which scan also the DG endpoints, should we avoid it?
  • Should it be avoided to run security scanner to detect vulnerability against Data Grid ports?
  • What to do if a security scanner detects a DG server is vulnerable?
  • We have several WARN and ERROR messages found in our logfile, what is the purpose or it? Here some examples
WARN  [org.infinispan.rest.Http20RequestHandler] (REST-ServerWorker-5-6) ISPN012006: Uncaught exception in the pipeline: java.lang.StringIndexOutOfBoundsException: String index out of range: -1
    at java.lang.String.substring(String.java:1931)
    at org.infinispan.rest.InfinispanRequestFactory.createRequest(InfinispanRequestFactory.java:35)
    at org.infinispan.rest.Http20RequestHandler.channelRead0(Http20RequestHandler.java:53)
    at org.infinispan.rest.Http11RequestHandler.channelRead0(Http11RequestHandler.java:35)
    at org.infinispan.rest.Http11RequestHandler.channelRead0(Http11RequestHandler.java:18)
    at io.netty.channel.SimpleChannelInboundHandler.channelRead(SimpleChannelInboundHandler.java:105)
    ...

ERROR [org.infinispan.server.memcached.MemcachedDecoder] (Memcached-ServerWorker-4-2) ISPN005003: Exception reported: org.infinispan.server.memcached.UnknownOperationException: Unknown operation: �\00�\�.6$4'  "׾�i��7#�'����ٮ�\00�\00\00\00\00\00\00\00\00\00\00
\00\00\00 \00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00"\00#\00
    at org.infinispan.server.memcached.MemcachedDecoder.toRequest(MemcachedDecoder.java:1076)
    at org.infinispan.server.memcached.MemcachedDecoder.readHeader(MemcachedDecoder.java:327)
    at org.infinispan.server.memcached.MemcachedDecoder.decodeHeader(MemcachedDecoder.java:207)
    at org.infinispan.server.memcached.MemcachedDecoder.decodeDispatch(MemcachedDecoder.java:185)
    at org.infinispan.server.memcached.MemcachedDecoder.decode(MemcachedDecoder.java:138)
    at io.netty.handler.codec.ReplayingDecoder.callDecode(ReplayingDecoder.java:367)
    ...

ERROR [org.infinispan.server.memcached.MemcachedDecoder] (Memcached-ServerWorker-4-3) ISPN005003: Exception reported: org.infinispan.server.memcached.UnknownOperationException: Unknown operation: \00�\00�\00\�.6$4'  "׾�i��7#�'����ٮ�\00�\00\00\00\00\00\00\00\00\00\00 \00\00\00  \00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00"\00#\00
    ...

2018-12-01 01:20:09,635 WARN  [org.infinispan.rest.Http20RequestHandler] (REST-ServerWorker-5-1) ISPN012006: Uncaught exception in the pipeline: java.lang.IllegalArgumentException: invalid escape sequence `%lo' at index 0 of: %login-config.xml

The new DG 7.3.6 cluster are crashing with this error:

2020-11-13 02:53:45,265 ERROR [org.infinispan.rest.Http20RequestHandler] (REST-ServerIO-5-14) ISPN012006: Uncaught exception in the pipeline: java.lang.IllegalArgumentException: unterminated escape sequence at index 0 of: %.
        at io.netty.handler.codec.http.QueryStringDecoder.decodeComponent(QueryStringDecoder.java:371)
        at io.netty.handler.codec.http.QueryStringDecoder.path(QueryStringDecoder.java:189)
        at org.infinispan.rest.InfinispanRequestFactory.createRequest(InfinispanRequestFactory.java:35)
        at org.infinispan.rest.Http20RequestHandler.channelRead0(Http20RequestHandler.java:54)
        at org.infinispan.rest.Http11RequestHandler.channelRead0(Http11RequestHandler.java:35)
        at org.infinispan.rest.Http11RequestHandler.channelRead0(Http11RequestHandler.java:18)
        at io.netty.channel.SimpleChannelInboundHandler.channelRead(SimpleChannelInboundHandler.java:99)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355)
        at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355)
        at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355)
        at io.netty.handler.codec.MessageToMessageDecoder.channelRead(MessageToMessageDecoder.java:102)
        at io.netty.handler.codec.MessageToMessageCodec.channelRead(MessageToMessageCodec.java:111)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355)
        at org.infinispan.rest.cors.CorsHandler.channelRead(CorsHandler.java:75)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355)
        at io.netty.channel.CombinedChannelDuplexHandler$DelegatingChannelHandlerContext.fireChannelRead(CombinedChannelDuplexHandler.java:436)
        at io.netty.handler.codec.ByteToMessageDecoder.fireChannelRead(ByteToMessageDecoder.java:321)
        at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:295)
        at io.netty.channel.CombinedChannelDuplexHandler.channelRead(CombinedChannelDuplexHandler.java:251)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355)
        at io.netty.channel.ChannelInboundHandlerAdapter.channelRead(ChannelInboundHandlerAdapter.java:93)
        at org.infinispan.server.core.transport.StatsChannelHandler.channelRead(StatsChannelHandler.java:26)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:355)
        at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:377)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:363)
        at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)
        at io.netty.channel.epoll.AbstractEpollStreamChannel$EpollStreamUnsafe.epollInReady(AbstractEpollStreamChannel.java:792)
        at io.netty.channel.epoll.EpollEventLoop.processReady(EpollEventLoop.java:475)
        at io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:378)
        at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989)
        at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.lang.Thread.run(Thread.java:748)

Environment

  • Red Hat Data Grid (RHDG)
    • 7.x

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content