You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@druid.apache.org by "janjwerner-confluent (via GitHub)" <gi...@apache.org> on 2023/11/21 01:23:34 UTC
[PR] resolve multiple CVEs (druid)
janjwerner-confluent opened a new pull request, #15407:
URL: https://github.com/apache/druid/pull/15407
Fixes # Multiple CVEs in dependencies. .
### Description
Update multiple dependencies to clear CVEs
CVE-2023-46120 in com.rabbitmq:amqp-client
CVE-2023-2976 in Guava
CVE-2023-39410 in Avro
CVE-2022-42003 CVE-2022-42004 in Jackson-databind
CVE-2020-11979 CVE-2020-1945 CVE-2021-36373 CVE-2021-36374 in Ant
CVE-2023-42503 in Commons-compress
CVE-2023-31582 GHSA-jgvc-jfgh-rjvv in
jose4j
CVE-2023-33201 bouncycastle
updated licenses and suppressions.
This PR has:
- [ x] been self-reviewed.
- [ ] using the [concurrency checklist](https://github.com/apache/druid/blob/master/dev/code-review/concurrency.md) (Remove this item if the PR doesn't have any relation to concurrency.)
- [ ] added documentation for new or modified features or behaviors.
- [ ] a release note entry in the PR description.
- [ ] added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
- [ x] added or updated version, license, or notice information in [licenses.yaml](https://github.com/apache/druid/blob/master/dev/license.md)
- [ ] added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
- [ ] added unit tests or modified existing tests to cover new code paths, ensuring the threshold for [code coverage](https://github.com/apache/druid/blob/master/dev/code-review/code-coverage.md) is met.
- [ ] added integration tests.
- [ ] been tested in a test Druid cluster.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] resolve multiple CVEs (druid)
Posted by "janjwerner-confluent (via GitHub)" <gi...@apache.org>.
janjwerner-confluent commented on PR #15407:
URL: https://github.com/apache/druid/pull/15407#issuecomment-1824657478
@abhishekagarwal87
Could you help me with the web-checks failing.
I am fixing the remaining license and CVE issues, but I'm stomped with the e2e test.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] resolve multiple CVEs (druid)
Posted by "janjwerner-confluent (via GitHub)" <gi...@apache.org>.
janjwerner-confluent commented on PR #15407:
URL: https://github.com/apache/druid/pull/15407#issuecomment-1834192379
closing this PR as it's being addressed with a series of smaller efforts.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] resolve multiple CVEs (druid)
Posted by "janjwerner-confluent (via GitHub)" <gi...@apache.org>.
janjwerner-confluent commented on PR #15407:
URL: https://github.com/apache/druid/pull/15407#issuecomment-1826441500
Cannot update elasticsearch to CVE-2023-31418 CVE-2021-22134 CVE-2021-22135 CVE-2021-22144 CVE-2023-31417 CVE-2023-31419 CVE-2023-46673
nor the elasticsearch-rest-client to address CVE-2021-22145
as Elastic changed the licenses to non permissive dual license.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] resolve multiple CVEs (druid)
Posted by "janjwerner-confluent (via GitHub)" <gi...@apache.org>.
janjwerner-confluent closed pull request #15407: resolve multiple CVEs
URL: https://github.com/apache/druid/pull/15407
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] resolve multiple CVEs (druid)
Posted by "janjwerner-confluent (via GitHub)" <gi...@apache.org>.
janjwerner-confluent commented on code in PR #15407:
URL: https://github.com/apache/druid/pull/15407#discussion_r1405264399
##########
distribution/bin/check-licenses.py:
##########
@@ -202,8 +203,20 @@
def set_license(self, data):
if data.upper().find("GPL") < 0:
- if self.license != 'Apache License version 2.0':
- self.license = self.compatible_license_names[data]
+ # Check if the license assosciated with the component is acccepted
+ # set_license() will pick the first acceptable license
+ # this fixes issue where a multi-licensed component
+ # could override accepted license with not accepted one
+ # e.g., EPL / GPL for logback-core
+ if self.license not in self.compatible_license_names:
+ try:
+ self.license = self.compatible_license_names[data]
+ except:
Review Comment:
resolved
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] resolve multiple CVEs (druid)
Posted by "github-advanced-security[bot] (via GitHub)" <gi...@apache.org>.
github-advanced-security[bot] commented on code in PR #15407:
URL: https://github.com/apache/druid/pull/15407#discussion_r1402991886
##########
distribution/bin/check-licenses.py:
##########
@@ -202,8 +203,20 @@
def set_license(self, data):
if data.upper().find("GPL") < 0:
- if self.license != 'Apache License version 2.0':
- self.license = self.compatible_license_names[data]
+ # Check if the license assosciated with the component is acccepted
+ # set_license() will pick the first acceptable license
+ # this fixes issue where a multi-licensed component
+ # could override accepted license with not accepted one
+ # e.g., EPL / GPL for logback-core
+ if self.license not in self.compatible_license_names:
+ try:
+ self.license = self.compatible_license_names[data]
+ except:
Review Comment:
## Except block handles 'BaseException'
Except block directly handles BaseException.
[Show more details](https://github.com/apache/druid/security/code-scanning/5996)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org