You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "anupamaggarwal (via GitHub)" <gi...@apache.org> on 2025/01/03 10:13:15 UTC
[PR] [test] fix for jackson-mapper-asl 1.9.13 [flink]
anupamaggarwal opened a new pull request, #25890:
URL: https://github.com/apache/flink/pull/25890
<!--
*Thank you very much for contributing to Apache Flink - we are happy that you want to help us improve Flink. To help the community review your contribution in the best possible way, please go through the checklist below, which will get the contribution into a shape in which it can be best reviewed.*
*Please understand that we do not do this to make contributions to Flink a hassle. In order to uphold a high standard of quality for code contributions, while at the same time managing a large number of contributions, we need contributors to prepare the contributions well, and give reviewers enough contextual information for the review. Please also understand that contributions that do not follow this guide will take longer to review and thus typically be picked up with lower priority by the community.*
## Contribution Checklist
- Make sure that the pull request corresponds to a [JIRA issue](https://issues.apache.org/jira/projects/FLINK/issues). Exceptions are made for typos in JavaDoc or documentation files, which need no JIRA issue.
- Name the pull request in the form "[FLINK-XXXX] [component] Title of the pull request", where *FLINK-XXXX* should be replaced by the actual issue number. Skip *component* if you are unsure about which is the best component.
Typo fixes that have no associated JIRA issue should be named following this pattern: `[hotfix] [docs] Fix typo in event time introduction` or `[hotfix] [javadocs] Expand JavaDoc for PuncuatedWatermarkGenerator`.
- Fill out the template below to describe the changes contributed by the pull request. That will give reviewers the context they need to do the review.
- Make sure that the change passes the automated tests, i.e., `mvn clean verify` passes. You can set up Azure Pipelines CI to do that following [this guide](https://cwiki.apache.org/confluence/display/FLINK/Azure+Pipelines#AzurePipelines-Tutorial:SettingupAzurePipelinesforaforkoftheFlinkrepository).
- Each pull request should address only one issue, not mix up code from multiple issues.
- Each commit in the pull request has a meaningful commit message (including the JIRA id)
- Once all items of the checklist are addressed, remove the above text and this checklist, leaving only the filled out template below.
**(The sections below can be removed for hotfixes of typos)**
-->
## What is the purpose of the change
Fix [CVE-2019-10202](https://nvd.nist.gov/vuln/detail/cve-2019-10202) in org.codehaus.jackson:jackson-mapper-asl:jar:1.9.13
More details at https://nvd.nist.gov/vuln/detail/cve-2019-10202
## Brief change log
- Add repository for redhat
- Explicitly pin version not yet being flagged https://mvnrepository.com/artifact/org.codehaus.jackson/jackson-mapper-asl/1.9.14.jdk17-redhat-00001
## Verifying this change
This change is a trivial rework / code cleanup without any test coverage.
## Does this pull request potentially affect one of the following parts:
- Dependencies (does it add or upgrade a dependency): (yes)
- The public API, i.e., is any changed class annotated with `@Public(Evolving)`: ( no)
- The serializers: ( no )
- The runtime per-record code paths (performance sensitive): (no)
- Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: (no)
- The S3 file system connector: (no)
## Documentation
- Does this pull request introduce a new feature? (no)
- If yes, how is the feature documented? (not applicable / docs / JavaDocs / not documented)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37078] Fix for jackson-mapper-asl 1.9.13 vulnerability [flink]
Posted by "rmetzger (via GitHub)" <gi...@apache.org>.
rmetzger commented on PR #25890:
URL: https://github.com/apache/flink/pull/25890#issuecomment-2788896356
@anupamaggarwal could you do me a favor and rebase this PR? Looks like te flink-sq-connector-hive has been removed in the latest master, so the rebase should be simple.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37078] Fix for jackson-mapper-asl 1.9.13 vulnerability [flink]
Posted by "rmetzger (via GitHub)" <gi...@apache.org>.
rmetzger commented on PR #25890:
URL: https://github.com/apache/flink/pull/25890#issuecomment-2841291906
Thanks for the rebase.
Looks like there is some unrelated test failure:
```
Apr 30 08:17:51 08:17:51.422 [ERROR] OpenTelemetryMetricReporterITCase.testReport:92->OpenTelemetryTestBase.eventuallyConsumeJson:84->OpenTelemetryTestBase.eventually:117->OpenTelemetryTestBase.eventually:125->OpenTelemetryTestBase.lambda$eventuallyConsumeJson$2:89->OpenTelemetryTestBase.lambda$eventuallyConsumeJson$1:109 ยป ConsumeDataLog java.lang.AssertionError:
Apr 30 08:17:51 Expecting ArrayList:
Apr 30 08:17:51 ["flink.logical.scope.foo.counter", "flink.logical.scope.foo.gauge"]
Apr 30 08:17:51 to contain:
Apr 30 08:17:51 ["flink.logical.scope.foo.counter",
Apr 30 08:17:51 "flink.logical.scope.foo.gauge",
Apr 30 08:17:51 "flink.logical.scope.foo.meter.count",
Apr 30 08:17:51 "flink.logical.scope.foo.meter.rate",
Apr 30 08:17:51 "flink.logical.scope.foo.histogram"]
Apr 30 08:17:51 but could not find the following element(s):
Apr 30 08:17:51 ["flink.logical.scope.foo.meter.count",
Apr 30 08:17:51 "flink.logical.scope.foo.meter.rate",
Apr 30 08:17:51 "flink.logical.scope.foo.histogram"]
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37078] Fix for jackson-mapper-asl 1.9.13 vulnerability [flink]
Posted by "anupamaggarwal (via GitHub)" <gi...@apache.org>.
anupamaggarwal commented on PR #25890:
URL: https://github.com/apache/flink/pull/25890#issuecomment-2586500686
@flinkbot run azure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37078] Fix for jackson-mapper-asl 1.9.13 vulnerability [flink]
Posted by "rmetzger (via GitHub)" <gi...@apache.org>.
rmetzger commented on code in PR #25890:
URL: https://github.com/apache/flink/pull/25890#discussion_r1908368391
##########
flink-connectors/flink-sql-connector-hive-3.1.3/src/main/resources/META-INF/NOTICE:
##########
@@ -45,7 +45,7 @@ the Apache Software License 2.0 (http://www.apache.org/licenses/LICENSE-2.0.txt)
- org.apache.orc:orc-tools:1.5.8
- org.apache.parquet:parquet-hadoop-bundle:1.10.0
- org.codehaus.jackson:jackson-core-asl:1.9.13
-- org.codehaus.jackson:jackson-mapper-asl:1.9.13
+- org.codehaus.jackson:jackson-mapper-asl:1.9.14.jdk17-redhat-00001
Review Comment:
Somehow the contained class files (at least the one I checked) is Java7 ?!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37078] Fix for jackson-mapper-asl 1.9.13 vulnerability [flink]
Posted by "rmetzger (via GitHub)" <gi...@apache.org>.
rmetzger commented on code in PR #25890:
URL: https://github.com/apache/flink/pull/25890#discussion_r1910165407
##########
pom.xml:
##########
@@ -328,6 +335,13 @@ under the License.
-->
<dependencies>
+ <!-- Setting default version for jackson-mapper-asl -->
+ <dependency>
+ <groupId>org.codehaus.jackson</groupId>
+ <artifactId>jackson-mapper-asl</artifactId>
+ <version>${jackson.mapper.asl.version}</version>
+ </dependency>
+
Review Comment:
Does this mean now any Flink dependency has `jackson-mapper-asl` as dep? e.g. if I'm depending on `flink-core`, will it pull in `jackson-mapper-asl` as well? (that wouldn't be good)
it seems this is true, right? https://stackoverflow.com/a/38882349
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37078] Fix for jackson-mapper-asl 1.9.13 vulnerability [flink]
Posted by "anupamaggarwal (via GitHub)" <gi...@apache.org>.
anupamaggarwal commented on PR #25890:
URL: https://github.com/apache/flink/pull/25890#issuecomment-2842323497
@flinkbot run azure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37078] Fix for jackson-mapper-asl 1.9.13 vulnerability [flink]
Posted by "rmetzger (via GitHub)" <gi...@apache.org>.
rmetzger commented on code in PR #25890:
URL: https://github.com/apache/flink/pull/25890#discussion_r1908361278
##########
flink-connectors/flink-sql-connector-hive-3.1.3/src/main/resources/META-INF/NOTICE:
##########
@@ -45,7 +45,7 @@ the Apache Software License 2.0 (http://www.apache.org/licenses/LICENSE-2.0.txt)
- org.apache.orc:orc-tools:1.5.8
- org.apache.parquet:parquet-hadoop-bundle:1.10.0
- org.codehaus.jackson:jackson-core-asl:1.9.13
-- org.codehaus.jackson:jackson-mapper-asl:1.9.13
+- org.codehaus.jackson:jackson-mapper-asl:1.9.14.jdk17-redhat-00001
Review Comment:
do you know what the `jdk17` is about?
The tests seem to pass on Java11 .. but maybe the tests are not actually using the jackson mapper code (since it is in hive and azure fs only?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37078] Fix for jackson-mapper-asl 1.9.13 vulnerability [flink]
Posted by "anupamaggarwal (via GitHub)" <gi...@apache.org>.
anupamaggarwal commented on PR #25890:
URL: https://github.com/apache/flink/pull/25890#issuecomment-2840935863
@flinkbot run azure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [DRAFT/test] fix for jackson-mapper-asl 1.9.13 [flink]
Posted by "flinkbot (via GitHub)" <gi...@apache.org>.
flinkbot commented on PR #25890:
URL: https://github.com/apache/flink/pull/25890#issuecomment-2569010328
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "73d464899f8b20cc910b3fb4a59ffe15de353290",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "73d464899f8b20cc910b3fb4a59ffe15de353290",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 73d464899f8b20cc910b3fb4a59ffe15de353290 UNKNOWN
<details>
<summary>Bot commands</summary>
The @flinkbot bot supports the following commands:
- `@flinkbot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37078] Fix for jackson-mapper-asl 1.9.13 vulnerability [flink]
Posted by "rmetzger (via GitHub)" <gi...@apache.org>.
rmetzger commented on code in PR #25890:
URL: https://github.com/apache/flink/pull/25890#discussion_r1910162122
##########
flink-connectors/flink-sql-connector-hive-3.1.3/src/main/resources/META-INF/NOTICE:
##########
@@ -45,7 +45,7 @@ the Apache Software License 2.0 (http://www.apache.org/licenses/LICENSE-2.0.txt)
- org.apache.orc:orc-tools:1.5.8
- org.apache.parquet:parquet-hadoop-bundle:1.10.0
- org.codehaus.jackson:jackson-core-asl:1.9.13
-- org.codehaus.jackson:jackson-mapper-asl:1.9.13
+- org.codehaus.jackson:jackson-mapper-asl:1.9.14.jdk17-redhat-00001
Review Comment:
okay, I see. I would say we do it, given that the tests are passing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37078] Fix for jackson-mapper-asl 1.9.13 vulnerability [flink]
Posted by "rmetzger (via GitHub)" <gi...@apache.org>.
rmetzger merged PR #25890:
URL: https://github.com/apache/flink/pull/25890
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37078] Fix for jackson-mapper-asl 1.9.13 vulnerability [flink]
Posted by "anupamaggarwal (via GitHub)" <gi...@apache.org>.
anupamaggarwal commented on code in PR #25890:
URL: https://github.com/apache/flink/pull/25890#discussion_r1912830806
##########
pom.xml:
##########
@@ -328,6 +335,13 @@ under the License.
-->
<dependencies>
+ <!-- Setting default version for jackson-mapper-asl -->
+ <dependency>
+ <groupId>org.codehaus.jackson</groupId>
+ <artifactId>jackson-mapper-asl</artifactId>
+ <version>${jackson.mapper.asl.version}</version>
+ </dependency>
+
Review Comment:
thanks @rmetzger
This should not be the case since it's included only in the `dependencyManagement` section.
My understanding is that in this mode the dependency will only be introduced if a child pom directly refers to `jackson-mapper-asl`, and not otherwise (Also the child pom does not have to specify the version of jackson-mapper-asl and it will be determined from the parent pom)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37078] Fix for jackson-mapper-asl 1.9.13 vulnerability [flink]
Posted by "anupamaggarwal (via GitHub)" <gi...@apache.org>.
anupamaggarwal commented on code in PR #25890:
URL: https://github.com/apache/flink/pull/25890#discussion_r1908738513
##########
flink-connectors/flink-sql-connector-hive-3.1.3/src/main/resources/META-INF/NOTICE:
##########
@@ -45,7 +45,7 @@ the Apache Software License 2.0 (http://www.apache.org/licenses/LICENSE-2.0.txt)
- org.apache.orc:orc-tools:1.5.8
- org.apache.parquet:parquet-hadoop-bundle:1.10.0
- org.codehaus.jackson:jackson-core-asl:1.9.13
-- org.codehaus.jackson:jackson-mapper-asl:1.9.13
+- org.codehaus.jackson:jackson-mapper-asl:1.9.14.jdk17-redhat-00001
Review Comment:
thanks @rmetzger , no clue unfortunately.
You are correct the class file has java7 (and the manifest says `Created-By: 1.8.0_121`), so I am guessing it should be ok.
There seem to be other projects also using this jar
https://github.com/search?type=code&q=jackson-mapper-asl+1.9.14.jdk17-redhat-00001
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org