You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@dubbo.apache.org by GitBox <gi...@apache.org> on 2021/09/30 09:06:25 UTC
[GitHub] [dubbo-samples] CVEDetect opened a new issue #373: Dependency org.apache.zookeeper:zookeeper, leading to CVE problem
CVEDetect opened a new issue #373:
URL: https://github.com/apache/dubbo-samples/issues/373
Hi, In **dubbo-samples-master/dubbo-samples-async/dubbo-samples-async-onerror**，there is a dependency **org.apache.zookeeper:zookeeper:3.4.13** that calls the risk method.
[CVE-2019-0201](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0201)
The scope of this CVE affected version is **[,3.4.14),[3.5.0-alpha, 3.5.5)**
After further analysis, in this project, the main Api called is **<org.apache.zookeeper.server.FinalRequestProcessor: void processRequest(org.apache.zookeeper.server.Request)>**
Risk method repair link : [GitHub](https://github.com/apache/zookeeper/commit/af741cb319d4760cfab1cd3b560635adacd8deca)
**CVE Bug Invocation Path--**
**Path Length : 3**
```
<org.apache.zookeeper.server.FinalRequestProcessor: void processRequest(org.apache.zookeeper.server.Request)>
at <org.apache.zookeeper.server.quorum.CommitProcessor: void run()> (org.apache.zookeeper.server.quorum.CommitProcessor.java:[77]) in /.m2/repository/org/apache/zookeeper/zookeeper/3.4.13/zookeeper-3.4.13.jar
at <org.apache.dubbo.samples.governance.EmbeddedZooKeeper: void start()> (org.apache.dubbo.samples.governance.EmbeddedZooKeeper.java:[162]) in /detect/unzip/dubbo-samples-master/dubbo-samples-async/dubbo-samples-async-onerror/target/classes
```
**Dependency tree--**
```
[INFO] org.apache.dubbo:dubbo-samples-async-onerror:jar:1.0-SNAPSHOT
[INFO] +- org.apache.curator:curator-framework:jar:4.0.1:compile
[INFO] | \- org.apache.curator:curator-client:jar:4.0.1:compile
[INFO] | \- com.google.guava:guava:jar:20.0:compile
[INFO] +- org.apache.zookeeper:zookeeper:jar:3.4.13:compile
[INFO] | +- org.slf4j:slf4j-api:jar:1.7.25:compile
[INFO] | +- org.slf4j:slf4j-log4j12:jar:1.7.25:compile
[INFO] | +- log4j:log4j:jar:1.2.16:compile
[INFO] | +- jline:jline:jar:0.9.94:compile
[INFO] | \- org.apache.yetus:audience-annotations:jar:0.5.0:compile
[INFO] +- org.apache.curator:curator-x-discovery:jar:4.0.1:compile
[INFO] | +- org.apache.curator:curator-recipes:jar:4.0.1:compile
[INFO] | \- org.codehaus.jackson:jackson-mapper-asl:jar:1.9.13:compile
[INFO] | \- org.codehaus.jackson:jackson-core-asl:jar:1.9.13:compile
[INFO] +- org.apache.dubbo:dubbo:jar:2.7.7:compile
[INFO] | +- com.alibaba.spring:spring-context-support:jar:1.0.6:compile
[INFO] | +- org.javassist:javassist:jar:3.21.0-GA:compile
[INFO] | +- com.google.code.gson:gson:jar:2.8.4:compile
[INFO] | \- org.yaml:snakeyaml:jar:1.17:compile
[INFO] +- org.apache.dubbo:dubbo-configcenter-zookeeper:jar:2.7.4:compile
[INFO] | +- org.apache.dubbo:dubbo-configcenter-api:jar:2.7.4:compile
[INFO] | | \- org.apache.dubbo:dubbo-common:jar:2.7.7:compile
[INFO] | | +- com.alibaba:fastjson:jar:1.2.68:compile
[INFO] | | +- commons-io:commons-io:jar:2.6:compile
[INFO] | | \- javax.annotation:javax.annotation-api:jar:1.3.2:compile
[INFO] | \- org.apache.dubbo:dubbo-remoting-zookeeper:jar:2.7.4:compile
[INFO] | \- org.apache.dubbo:dubbo-remoting-api:jar:2.7.7:compile
[INFO] | \- org.apache.dubbo:dubbo-serialization-api:jar:2.7.7:compile
[INFO] +- io.netty:netty-all:jar:4.1.16.Final:compile
[INFO] +- org.slf4j:slf4j-simple:jar:1.7.25:compile
[INFO] +- org.springframework:spring-context:jar:4.3.16.RELEASE:compile
[INFO] | +- org.springframework:spring-aop:jar:4.3.16.RELEASE:compile
[INFO] | +- org.springframework:spring-beans:jar:4.3.16.RELEASE:compile
[INFO] | +- org.springframework:spring-core:jar:4.3.16.RELEASE:compile
[INFO] | | \- commons-logging:commons-logging:jar:1.2:compile
[INFO] | \- org.springframework:spring-expression:jar:4.3.16.RELEASE:compile
```
**_Suggested solutions:_**
Update dependency version
Thank you very much.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-samples] CVEDetect commented on issue #373: Dependency org.apache.zookeeper:zookeeper, leading to CVE problem
Posted by GitBox <gi...@apache.org>.
CVEDetect commented on issue #373:
URL: https://github.com/apache/dubbo-samples/issues/373#issuecomment-931097373
@plusmancn
Could please help me check this issue?
May I pull a request to fix it?
Thanks again.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-samples] AlbumenJ closed issue #373: Dependency org.apache.zookeeper:zookeeper, leading to CVE problem
Posted by GitBox <gi...@apache.org>.
AlbumenJ closed issue #373:
URL: https://github.com/apache/dubbo-samples/issues/373
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo-samples] AlbumenJ commented on issue #373: Dependency org.apache.zookeeper:zookeeper, leading to CVE problem
Posted by GitBox <gi...@apache.org>.
AlbumenJ commented on issue #373:
URL: https://github.com/apache/dubbo-samples/issues/373#issuecomment-932195789
> @plusmancn Could please help me check this issue? May I pull a request to fix it? Thanks again.
Please go ahead!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org