You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@calcite.apache.org by "hughpearse (via GitHub)" <gi...@apache.org> on 2025/01/22 22:22:47 UTC
[PR] updating local gemfile to remove CVE vulns [calcite]
hughpearse opened a new pull request, #4159:
URL: https://github.com/apache/calcite/pull/4159
<html>
<body>
<!--StartFragment--><p style="margin: 0px; padding: 0px; color: rgb(23, 43, 77); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Automated scans are failing of the repo blocking corporate process for library approval due to CVE vulnerability findings. Very minor change to site gemfile required to pass the scans.</p><p style="margin: 10px 0px 0px; padding: 0px; color: rgb(23, 43, 77); font-family: -apple-system, BlinkMacSystemFo
nt, "Segoe UI", Roboto, Oxygen, Ubuntu, "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Scanning tool is Trivy, and issue does not appear in owasp dependency-check.</p><p style="margin: 10px 0px 0px; padding: 0px; color: rgb(23, 43, 77); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; fo
nt-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;"> </p><ul style="margin: 10px 0px 0px; color: rgb(23, 43, 77); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color:
initial;"><li>Scan of <b><a href="https://github.com/apache/calcite*" class="external-link" target="_blank" rel="nofollow noopener" title="Follow link" style="color: rgb(0, 82, 204); text-decoration: var(--aui-link-decoration); cursor: pointer;">https://github.com/apache/calcite*</a> on *Jan 17, 2025</b><br>Repo Tag Scanned:<span> </span><b>calcite-1.38.0</b></li></ul><div class="table-wrap" style="margin: 0px; padding: 0px; color: rgb(23, 43, 77); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: i
nitial; text-decoration-style: initial; text-decoration-color: initial;">
Vulnerabilities
--
HIGH | rexml | 3.2.5 | >= 3.3.9 | CVE-2024-49761 | https://avd.aquasec.com/nvd/cve-2024-49761
HIGH | webrick | 1.7.0 | >= 1.8.2 | CVE-2024-47220 | https://avd.aquasec.com/nvd/cve-2024-47220
MEDIUM | nokogiri | 1.14.3 | 1.15.6, 1.16.2 | GHSA-vcc3-rw6f-jv97 | https://github.com/advisories/GHSA-vcc3-rw6f-jv97
MEDIUM | nokogiri | 1.14.3 | ~> 1.15.6, >= 1.16.2 | GHSA-xc9x-jj77-9p9j | https://github.com/advisories/GHSA-xc9x-jj77-9p9j
MEDIUM | rexml | 3.2.5 | >= 3.2.7 | CVE-2024-35176 | https://avd.aquasec.com/nvd/cve-2024-35176
MEDIUM | rexml | 3.2.5 | >= 3.3.2 | CVE-2024-39908 | https://avd.aquasec.com/nvd/cve-2024-39908
MEDIUM | rexml | 3.2.5 | >= 3.3.3 | CVE-2024-41123 | https://avd.aquasec.com/nvd/cve-2024-41123
MEDIUM | rexml | 3.2.5 | >= 3.3.3 | CVE-2024-41946 | https://avd.aquasec.com/nvd/cve-2024-41946
MEDIUM | rexml | 3.2.5 | >= 3.3.6 | CVE-2024-43398 | https://avd.aquasec.com/nvd/cve-2024-43398
</div><p style="margin: 10px 0px 0px; padding: 0px; color: rgb(23, 43, 77); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, "Fira Sans", "Droid Sans", "Helvetica Neue", sans-serif; font-size: 14px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; white-space: normal; background-color: rgb(255, 255, 255); text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">Solution is to update the site Gemfile</p><!--EndFragment-->
</body>
</html>
See following Jira ticket
[CALCITE-6794](https://issues.apache.org/jira/browse/CALCITE-6794)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@calcite.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CALCITE-6794] Site Gemfile contains vulnerable ruby libraries [calcite]
Posted by "NobiGo (via GitHub)" <gi...@apache.org>.
NobiGo commented on PR #4159:
URL: https://github.com/apache/calcite/pull/4159#issuecomment-2609606337
Since this CI cannot cover the modified effects of this Site, it may be necessary to run it successfully locally before submitting.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@calcite.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CALCITE-6794] Site Gemfile contains vulnerable ruby libraries [calcite]
Posted by "hughpearse (via GitHub)" <gi...@apache.org>.
hughpearse commented on PR #4159:
URL: https://github.com/apache/calcite/pull/4159#issuecomment-2610327674
to fix unit test I needed to rewrite commit history, easier to move PR to here
[PR#4162](https://github.com/apache/calcite/pull/4162)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@calcite.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CALCITE-6794] Site Gemfile contains vulnerable ruby libraries [calcite]
Posted by "hughpearse (via GitHub)" <gi...@apache.org>.
hughpearse commented on PR #4159:
URL: https://github.com/apache/calcite/pull/4159#issuecomment-2609636382
Runs locally
```
foo@bar$ sudo docker run -t -i -p 4000:4000 --entrypoint /bin/bash ruby:3.3.7-slim-bullseye
foo@bar$ apt update
foo@bar$ apt install build-essential libssl-dev zlib1g-dev git ruby-dev vim
foo@bar$ git clone https://github.com/hughpearse/calcite.git
foo@bar$ cd calcite/site
foo@bar$ gem install bundler
foo@bar$ bundle install
foo@bar$ bundle exec jekyll serve --host=0.0.0.0
```
http://localhost:4000
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@calcite.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CALCITE-6794] Site Gemfile contains vulnerable ruby libraries [calcite]
Posted by "ILuffZhe (via GitHub)" <gi...@apache.org>.
ILuffZhe commented on PR #4159:
URL: https://github.com/apache/calcite/pull/4159#issuecomment-2609880031
@hughpearse Your change failed at `org.apache.calcite.test.LintTest`, and you can run this test locally and fix it.
And thanks for sharing the scan report.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@calcite.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CALCITE-6794: updating local gemfile to remove CVE vulns [calcite]
Posted by "ILuffZhe (via GitHub)" <gi...@apache.org>.
ILuffZhe commented on code in PR #4159:
URL: https://github.com/apache/calcite/pull/4159#discussion_r1926199595
##########
site/Gemfile:
##########
@@ -15,8 +15,8 @@
#
source 'https://rubygems.org'
gem 'jekyll', '~>4'
-gem "webrick", "~> 1.7"
-gem "nokogiri", "~> 1.14"
+gem "webrick", "~> 1.9"
Review Comment:
Hi @hughpearse , your commit info should be like "[CALCITE-XX] Jira ticket summary". See https://calcite.apache.org/develop/#contributing.
By the way, how can we get the scan result after your fix, in 1.39.0 release?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@calcite.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CALCITE-6794] Site Gemfile contains vulnerable ruby libraries [calcite]
Posted by "hughpearse (via GitHub)" <gi...@apache.org>.
hughpearse commented on PR #4159:
URL: https://github.com/apache/calcite/pull/4159#issuecomment-2609675094
Trivy scan completed on my fork
```
Approved Libraries
Libraries within this report have passed our security review and can be given to Technology Governance for next steps.
Scan of https://github.com/hughpearse/calcite on Jan 23, 2025
Version Scanned: latest
Commit in the last 730 days: True
Reviewers found: 478, of required: 2 reviewers. Pass: True
This library has no Critical, High, or Medium vulnerabilities
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@calcite.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CALCITE-6794: updating local gemfile to remove CVE vulns [calcite]
Posted by "hughpearse (via GitHub)" <gi...@apache.org>.
hughpearse commented on PR #4159:
URL: https://github.com/apache/calcite/pull/4159#issuecomment-2608948073
Hi thanks I will update the title today to confirm to the accepted
standard. I can share the scan report in chat but you can also see the CVEs
here
Currently used
https://secure.software/rubygems/packages/nokogiri/1.14.3
https://secure.software/rubygems/packages/webrick/1.7.0
https://secure.software/rubygems/packages/rexml/vulnerabilities/3.2.5
Next available release
https://secure.software/rubygems/packages/nokogiri/1.17.2
https://secure.software/rubygems/packages/webrick/1.8.2
https://secure.software/rubygems/packages/rexml/vulnerabilities/3.3.9
On Thu, 23 Jan 2025, 00:45 ILuffZhe, ***@***.***> wrote:
> ***@***.**** commented on this pull request.
> ------------------------------
>
> In site/Gemfile
> <https://github.com/apache/calcite/pull/4159#discussion_r1926199595>:
>
> > @@ -15,8 +15,8 @@
> #
> source 'https://rubygems.org'
> gem 'jekyll', '~>4'
> -gem "webrick", "~> 1.7"
> -gem "nokogiri", "~> 1.14"
> +gem "webrick", "~> 1.9"
>
> Hi @hughpearse <https://github.com/hughpearse> , your commit info should
> be like "[CALCITE-XX] Jira ticket summary". See
> https://calcite.apache.org/develop/#contributing.
> By the way, how can we get the scan result after your fix, in 1.39.0
> release?
>
> —
> Reply to this email directly, view it on GitHub
> <https://github.com/apache/calcite/pull/4159#pullrequestreview-2568621128>,
> or unsubscribe
> <https://github.com/notifications/unsubscribe-auth/AAFGMU55AYDGORI3YG2GBAL2MA3RNAVCNFSM6AAAAABVV7I6VGVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMZDKNRYGYZDCMJSHA>
> .
> You are receiving this because you were mentioned.Message ID:
> ***@***.***>
>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@calcite.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [CALCITE-6794] Site Gemfile contains vulnerable ruby libraries [calcite]
Posted by "hughpearse (via GitHub)" <gi...@apache.org>.
hughpearse closed pull request #4159: [CALCITE-6794] Site Gemfile contains vulnerable ruby libraries
URL: https://github.com/apache/calcite/pull/4159
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@calcite.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org