You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@arrow.apache.org by "everin (via GitHub)" <gi...@apache.org> on 2026/04/14 12:53:43 UTC
[I] Update shaded dependencies in Flight SQL JDBC 19.0.0 (multiple CVEs) [arrow-java]
everin opened a new issue, #1115:
URL: https://github.com/apache/arrow-java/issues/1115
### Describe the enhancement requested
Hello Apache Arrow team,
first of all, thank you for your work on Arrow and the Flight SQL JDBC driver.
We are currently using the Flight SQL JDBC driver version 19.0.0 and, during a routine security scan of our artifacts (Docker image), we identified several vulnerabilities affecting dependencies that appear to be **shaded within the driver JAR**.
Specifically, the following issues were reported:
* **High** – CVE-2024-57699 – net.minidev:json-smart
* **High** – CVE-2026-33871 – io.netty:netty-codec-http2
* **Medium** – GHSA-72hv-8253-57qq – com.fasterxml.jackson.core:jackson-core
* **Medium** – CVE-2025-53864 – com.nimbusds:nimbus-jose-jwt
Since these libraries are shaded, it is not possible for us to mitigate the vulnerabilities via standard dependency management (e.g., Maven/Gradle overrides).
We have already reached out to the Apache security channel to report and discuss this situation, but we would also like to ask here:
* Are there plans to update these shaded dependencies in an upcoming release?
* In particular, for the Netty HTTP/2 component, can you confirm whether it is actively used by the Flight SQL JDBC driver or if it could be considered non-critical in typical usage?
Thank you in advance for your support and for maintaining the project.
Kind regards
Everin Orlandi
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Update shaded dependencies in Flight SQL JDBC 19.0.0 (multiple CVEs) [arrow-java]
Posted by "everin (via GitHub)" <gi...@apache.org>.
everin commented on issue #1115:
URL: https://github.com/apache/arrow-java/issues/1115#issuecomment-4249942213
Thank you @jbonofre @lidavidm. I understand that your feedback regarding the CVE related to “netty” does not pertain to the use of client-side JDBC drivers.
If that is the case, and the dependency update has already been handled by “dependabot” for the next release of the JDBC drivers, may I close this issue?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Update shaded dependencies in Flight SQL JDBC 19.0.0 (multiple CVEs) [arrow-java]
Posted by "everin (via GitHub)" <gi...@apache.org>.
everin closed issue #1115: Update shaded dependencies in Flight SQL JDBC 19.0.0 (multiple CVEs)
URL: https://github.com/apache/arrow-java/issues/1115
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Update shaded dependencies in Flight SQL JDBC 19.0.0 (multiple CVEs) [arrow-java]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on issue #1115:
URL: https://github.com/apache/arrow-java/issues/1115#issuecomment-4244953250
@lidavidm thanks! It's what I was thinking.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Update shaded dependencies in Flight SQL JDBC 19.0.0 (multiple CVEs) [arrow-java]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm commented on issue #1115:
URL: https://github.com/apache/arrow-java/issues/1115#issuecomment-4244681214
Ah, but for the Flight SQL JDBC driver, that CVE does not apply, as it is for servers, and the JDBC driver only uses gRPC as a client.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Update shaded dependencies in Flight SQL JDBC 19.0.0 (multiple CVEs) [arrow-java]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on issue #1115:
URL: https://github.com/apache/arrow-java/issues/1115#issuecomment-4244060457
Hi @everin
dependabot already picked up dependency updates.
We also bumped Java version allowing us to upgrade to last dependencies versions.
I'm checking the dependencies you specifically mentioned (netty especially) for Arrow Java 20.0.0 release.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Update shaded dependencies in Flight SQL JDBC 19.0.0 (multiple CVEs) [arrow-java]
Posted by "jbonofre (via GitHub)" <gi...@apache.org>.
jbonofre commented on issue #1115:
URL: https://github.com/apache/arrow-java/issues/1115#issuecomment-4244785197
@lidavidm I don't think the JDBC Driver is actually using netty-http2, it's pure gRPC client. So I think the CVE does not apply.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Update shaded dependencies in Flight SQL JDBC 19.0.0 (multiple CVEs) [arrow-java]
Posted by "everin (via GitHub)" <gi...@apache.org>.
everin commented on issue #1115:
URL: https://github.com/apache/arrow-java/issues/1115#issuecomment-4281002980
Thank you all for your support
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Update shaded dependencies in Flight SQL JDBC 19.0.0 (multiple CVEs) [arrow-java]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm commented on issue #1115:
URL: https://github.com/apache/arrow-java/issues/1115#issuecomment-4244674797
AFAIK we do actively use netty-http2 as we use gRPC, and gRPC uses HTTP/2 and Netty.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Update shaded dependencies in Flight SQL JDBC 19.0.0 (multiple CVEs) [arrow-java]
Posted by "everin (via GitHub)" <gi...@apache.org>.
everin commented on issue #1115:
URL: https://github.com/apache/arrow-java/issues/1115#issuecomment-4244100045
Hi @jbonofre I really appreciate your feedback, thank you
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] Update shaded dependencies in Flight SQL JDBC 19.0.0 (multiple CVEs) [arrow-java]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm commented on issue #1115:
URL: https://github.com/apache/arrow-java/issues/1115#issuecomment-4244913604
gRPC is implemented on HTTP/2. So I assume gRPC must be using netty-http2 internally. But either way, that CVE is for servers, and the JDBC driver is purely a client, so it doesn't apply.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org