You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@arrow.apache.org by "rcprcp (via GitHub)" <gi...@apache.org> on 2023/12/18 22:42:12 UTC
[I] Flight SQL JDBC Driver has 2 CVEs blocking adoption in a customer's production environment. [arrow]
rcprcp opened a new issue, #39288:
URL: https://github.com/apache/arrow/issues/39288
### Describe the bug, including details regarding any error messages, version, and platform.
The Flight SQL JDBC driver link on mvnrepository
[https://mvnrepository.com/artifact/org.apache.arrow/flight-sql-jdbc-driver/14.0.1](https://mvnrepository.com/artifact/org.apache.arrow/flight-sql-jdbc-driver/14.0.1)
Links to these two CVE's:
Vulnerabilities from dependencies:
[CVE-2023-2976](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2976)
[CVE-2020-8908](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908)
These CVEs are blocking a customer's ability to use the driver in production, as the customer's Security Team objects to having these move to production.
Is it possible to upgrade the dependencies, test, and release a new version of the driver without these CVEs?
### Component(s)
Java
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Java][FlightSQL] Flight SQL JDBC Driver has 2 CVEs blocking adoption in a customer's production environment. [arrow]
Posted by "danepitkin (via GitHub)" <gi...@apache.org>.
danepitkin commented on issue #39288:
URL: https://github.com/apache/arrow/issues/39288#issuecomment-1864789613
Yes, that's it! Thank you @rcprcp, I truly appreciate it.
Can we update the title/description of this issue to match the PR?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Java][FlightSQL] Update Apache Avatica to version 1.24.0 [arrow]
Posted by "rcprcp (via GitHub)" <gi...@apache.org>.
rcprcp commented on issue #39288:
URL: https://github.com/apache/arrow/issues/39288#issuecomment-1864903574
Hi @lidavidm , is there an approximate date when Arrow Flight V15 will be released? Or, if there is going to be a 14.3.0 version released sooner, can we get this issue backported? If we go with 14.3.0, is there an approximate date for that? thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Java][FlightSQL] Flight SQL JDBC Driver has 2 CVEs blocking adoption in a customer's production environment. [arrow]
Posted by "rcprcp (via GitHub)" <gi...@apache.org>.
rcprcp commented on issue #39288:
URL: https://github.com/apache/arrow/issues/39288#issuecomment-1863331864
Hi @danepitkin - thanks for picking up this issue so quickly.
Your help with this is greatly appreciated. 🥇
We realize now that there is one other important CVE that's included in flight-sql-jdbc-driver and we also need this one resolved as well:
[https://nvd.nist.gov/vuln/detail/CVE-2022-36364](https://nvd.nist.gov/vuln/detail/CVE-2022-36364)
This vulnerability is introduced by the reference to Avatica v 1.18.0. In Avatica version 1.22.0 and above, this issue is resolved.
In [https://mvnrepository.com/artifact/org.apache.calcite.avatica/avatica-core](https://mvnrepository.com/artifact/org.apache.calcite.avatica/avatica-core)
Is it possible to also upgrade the Avatica dependency in the flight-sql-jdbc-driver?
Thank you for your help.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Java][FlightSQL] Update Apache Avatica to version 1.24.0 [arrow]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm commented on issue #39288:
URL: https://github.com/apache/arrow/issues/39288#issuecomment-1864929257
Releases are _roughly_ every 3 months. 14.3.0 is unlikely, 15.0.0 should be in January.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Java][FlightSQL] Update Apache Avatica to version 1.24.0 [arrow]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm closed issue #39288: [Java][FlightSQL] Update Apache Avatica to version 1.24.0
URL: https://github.com/apache/arrow/issues/39288
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Java][FlightSQL] Update Apache Avatica to version 1.24.0 [arrow]
Posted by "rcprcp (via GitHub)" <gi...@apache.org>.
rcprcp commented on issue #39288:
URL: https://github.com/apache/arrow/issues/39288#issuecomment-1864794232
@danepitkin thank you. Updated the issues's title.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Java][FlightSQL] Flight SQL JDBC Driver has 2 CVEs blocking adoption in a customer's production environment. [arrow]
Posted by "rcprcp (via GitHub)" <gi...@apache.org>.
rcprcp commented on issue #39288:
URL: https://github.com/apache/arrow/issues/39288#issuecomment-1863420045
Hi @danepitkin - sure.
If by "fix," we mean to change the pom files, run a few local tests, and submit a PR.
Please let me know if there is more to this than I am considering.
Thanks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Java][FlightSQL] Flight SQL JDBC Driver has 2 CVEs blocking adoption in a customer's production environment. [arrow]
Posted by "danepitkin (via GitHub)" <gi...@apache.org>.
danepitkin commented on issue #39288:
URL: https://github.com/apache/arrow/issues/39288#issuecomment-1862955949
Dependabot just upgraded the Guava lib to v32.1.3 https://github.com/apache/arrow/commit/307fbc5113985a52d2ad10d3ad2ca1a5b56ae0d5. One of the CVEs recommends upgrading to at least v32.0.1 so this might be fixed already. @rcprcp do you want to verify this resolves the issue?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Java][FlightSQL] Flight SQL JDBC Driver has 2 CVEs blocking adoption in a customer's production environment. [arrow]
Posted by "danepitkin (via GitHub)" <gi...@apache.org>.
danepitkin commented on issue #39288:
URL: https://github.com/apache/arrow/issues/39288#issuecomment-1863375962
Ah looks like Arrow is using v1.18:
JDBC Core https://github.com/apache/arrow/blob/6c326db6a5686a78bc77be662b61236ddbfc66dc/java/flight/flight-sql-jdbc-core/pom.xml#L131
JDBC Driver https://github.com/apache/arrow/blob/6c326db6a5686a78bc77be662b61236ddbfc66dc/java/flight/flight-sql-jdbc-driver/pom.xml#L117
Would you be willing to help contribute a fix for this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org