You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@iceberg.apache.org by "liko9 (via GitHub)" <gi...@apache.org> on 2025/07/15 17:32:56 UTC
[PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
liko9 opened a new pull request, #13561:
URL: https://github.com/apache/iceberg/pull/13561
removes commons-beanutils from non-hive deps, bump version to 1.11.0 to resolve CVE when using hive
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "ajantha-bhat (via GitHub)" <gi...@apache.org>.
ajantha-bhat commented on code in PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#discussion_r2209219898
##########
kafka-connect/build.gradle:
##########
@@ -64,9 +64,14 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-runtime') {
configurations {
hive {
extendsFrom runtimeClasspath
+ // force upgrades for dependencies with known vulnerabilities...
+ resolutionStrategy {
+ force 'commons-beanutils:commons-beanutils:1.11.0'
+ }
}
all {
exclude group: 'javax.activation', module: 'activation'
+ exclude group: 'commons-beanutils'
Review Comment:
The checkstyle fails because of this line. Do we really need to exclude it? If so, can we try giving a module?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "stevenzwu (via GitHub)" <gi...@apache.org>.
stevenzwu merged PR #13561:
URL: https://github.com/apache/iceberg/pull/13561
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "liko9 (via GitHub)" <gi...@apache.org>.
liko9 commented on code in PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#discussion_r2210793342
##########
kafka-connect/build.gradle:
##########
@@ -64,9 +64,14 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-runtime') {
configurations {
hive {
extendsFrom runtimeClasspath
+ // force upgrades for dependencies with known vulnerabilities...
+ resolutionStrategy {
+ force 'commons-beanutils:commons-beanutils:1.11.0'
Review Comment:
My thinking was that we didn't want/need this for the "all" target because that's a Hive dependency. That said, moving it here didn't include it in the non-hive distZip build so I've done as you asked.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "ajantha-bhat (via GitHub)" <gi...@apache.org>.
ajantha-bhat commented on code in PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#discussion_r2209112111
##########
kafka-connect/build.gradle:
##########
@@ -262,4 +267,4 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-transforms') {
test {
useJUnitPlatform()
}
-}
Review Comment:
please revert this line of change
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "ajantha-bhat (via GitHub)" <gi...@apache.org>.
ajantha-bhat commented on code in PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#discussion_r2211115485
##########
kafka-connect/build.gradle:
##########
@@ -64,9 +64,14 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-runtime') {
configurations {
hive {
extendsFrom runtimeClasspath
+ // force upgrades for dependencies with known vulnerabilities...
+ resolutionStrategy {
+ force 'commons-beanutils:commons-beanutils:1.11.0'
+ }
}
all {
exclude group: 'javax.activation', module: 'activation'
+ exclude group: 'commons-beanutils'
Review Comment:
Yes. We should focus on fixing CVE for main distribution (not hive) first. As that is the plugin we are gonna upload to confluent repo.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "liko9 (via GitHub)" <gi...@apache.org>.
liko9 commented on PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#issuecomment-3075546768
resolves https://github.com/apache/iceberg/issues/13563
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "ajantha-bhat (via GitHub)" <gi...@apache.org>.
ajantha-bhat commented on code in PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#discussion_r2209219898
##########
kafka-connect/build.gradle:
##########
@@ -64,9 +64,14 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-runtime') {
configurations {
hive {
extendsFrom runtimeClasspath
+ // force upgrades for dependencies with known vulnerabilities...
+ resolutionStrategy {
+ force 'commons-beanutils:commons-beanutils:1.11.0'
+ }
}
all {
exclude group: 'javax.activation', module: 'activation'
+ exclude group: 'commons-beanutils'
Review Comment:
The (compile) checkstyle fails because of this line. Do we really need to exclude it?
> When we add exclude group: 'commons-beanutils' to our configurations.all block, we are instructing Gradle to prevent any version of commons-beanutils from being included in any configuration's classpath for that project. This includes the classpath that Gradle sets up for its own plugins, like the Checkstyle plugin.
##########
kafka-connect/build.gradle:
##########
@@ -64,9 +64,14 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-runtime') {
configurations {
hive {
extendsFrom runtimeClasspath
+ // force upgrades for dependencies with known vulnerabilities...
+ resolutionStrategy {
+ force 'commons-beanutils:commons-beanutils:1.11.0'
+ }
}
all {
exclude group: 'javax.activation', module: 'activation'
+ exclude group: 'commons-beanutils'
Review Comment:
The (compile) checkstyle fails because of this line. Do we really need to exclude it?
When we add exclude group: 'commons-beanutils' to our configurations.all block, we are instructing Gradle to prevent any version of commons-beanutils from being included in any configuration's classpath for that project. This includes the classpath that Gradle sets up for its own plugins, like the Checkstyle plugin.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "stevenzwu (via GitHub)" <gi...@apache.org>.
stevenzwu commented on PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#issuecomment-3084598816
thanks @liko9 for the fix and @ajantha-bhat @nandorKollar for the review
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "liko9 (via GitHub)" <gi...@apache.org>.
liko9 commented on code in PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#discussion_r2211034266
##########
kafka-connect/build.gradle:
##########
@@ -64,9 +64,14 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-runtime') {
configurations {
hive {
extendsFrom runtimeClasspath
+ // force upgrades for dependencies with known vulnerabilities...
+ resolutionStrategy {
+ force 'commons-beanutils:commons-beanutils:1.11.0'
+ }
}
all {
exclude group: 'javax.activation', module: 'activation'
+ exclude group: 'commons-beanutils'
Review Comment:
My goal here is to not include it when not building for hive. But I'll file a separate issue for that and work on that for a future release. We don't need these hadoop deps for the non-Hive build. I'll update my PR shortly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "ajantha-bhat (via GitHub)" <gi...@apache.org>.
ajantha-bhat commented on code in PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#discussion_r2212319525
##########
kafka-connect/build.gradle:
##########
@@ -262,4 +263,4 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-transforms') {
test {
useJUnitPlatform()
}
-}
Review Comment:
+1
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "ajantha-bhat (via GitHub)" <gi...@apache.org>.
ajantha-bhat commented on code in PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#discussion_r2209219898
##########
kafka-connect/build.gradle:
##########
@@ -64,9 +64,14 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-runtime') {
configurations {
hive {
extendsFrom runtimeClasspath
+ // force upgrades for dependencies with known vulnerabilities...
+ resolutionStrategy {
+ force 'commons-beanutils:commons-beanutils:1.11.0'
+ }
}
all {
exclude group: 'javax.activation', module: 'activation'
+ exclude group: 'commons-beanutils'
Review Comment:
The (compile) checkstyle fails because of this line. Do we really need to exclude it? If so, can we try giving a module?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "ajantha-bhat (via GitHub)" <gi...@apache.org>.
ajantha-bhat commented on code in PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#discussion_r2209218886
##########
kafka-connect/build.gradle:
##########
@@ -64,9 +64,14 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-runtime') {
configurations {
hive {
extendsFrom runtimeClasspath
+ // force upgrades for dependencies with known vulnerabilities...
+ resolutionStrategy {
+ force 'commons-beanutils:commons-beanutils:1.11.0'
Review Comment:
I think we keep it under the `resolutionStrategy` at line 76?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "liko9 (via GitHub)" <gi...@apache.org>.
liko9 commented on code in PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#discussion_r2210791202
##########
kafka-connect/build.gradle:
##########
@@ -262,4 +267,4 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-transforms') {
test {
useJUnitPlatform()
}
-}
Review Comment:
Apologies for this - my IDE must have put that there unintentionally
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "ajantha-bhat (via GitHub)" <gi...@apache.org>.
ajantha-bhat commented on code in PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#discussion_r2210960084
##########
kafka-connect/build.gradle:
##########
@@ -64,9 +64,14 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-runtime') {
configurations {
hive {
extendsFrom runtimeClasspath
+ // force upgrades for dependencies with known vulnerabilities...
+ resolutionStrategy {
+ force 'commons-beanutils:commons-beanutils:1.11.0'
Review Comment:
> so I've done as you asked
Need to push these changes? PR looks to be not updated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "stevenzwu (via GitHub)" <gi...@apache.org>.
stevenzwu commented on code in PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#discussion_r2211564032
##########
kafka-connect/build.gradle:
##########
@@ -262,4 +263,4 @@ project(':iceberg-kafka-connect:iceberg-kafka-connect-transforms') {
test {
useJUnitPlatform()
}
-}
Review Comment:
nit: can we revert the unnecessary white space change
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [PR] kafka-connect: resolve CVE-2025-48734 [iceberg]
Posted by "ajantha-bhat (via GitHub)" <gi...@apache.org>.
ajantha-bhat commented on PR #13561:
URL: https://github.com/apache/iceberg/pull/13561#issuecomment-3076749023
I locally tried by just adding one line under existing `resolutionStrategy` and everything worked
`force 'commons-beanutils:commons-beanutils:1.11.0'`
Trivy also ran after that successfully.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org