You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ambari.apache.org by "JiaLiangC (via GitHub)" <gi...@apache.org> on 2026/09/08 02:52:48 UTC
[PR] AMBARI-26653: Fix vulnerable Java dependencies and remove unused Jettison [ambari]
JiaLiangC opened a new pull request, #4208:
URL: https://github.com/apache/ambari/pull/4208
## What changes were proposed in this pull request?
https://issues.apache.org/jira/browse/AMBARI-26653
Several runtime dependencies still use vulnerable versions, and server and
agent overrides prevent consistent upgrades. This PR contains five topic
commits, with focused tests alongside the behavior they verify:
- Upgrade managed BeanUtils 1.9.4 to 1.11.0 and verify enum class access is
suppressed while ordinary bean copying works (Dependabot #4021).
- Remove unused Jettison 1.1 dependency management and the server dependency,
retain the protective exclusion, and remove obsolete test exception
declarations (#3667).
- Align Commons Compress at 1.28.0 in server and agent. Remove the agent's
Commons IO override so both modules inherit compatible IO 2.21.0. Cover
actual configuration archive round trips and truncated gzip rejection.
The agent already contains #4001's 1.26.0 fix; the server was still at 1.21.
- Upgrade agent Configuration2 to 2.15.0 and its Commons Logging prerequisite
to 1.3.6, with existing credential-store and ZooKeeper tests (#4136).
- Align Jackson BOM, core, databind, and related modules at 2.18.9. Cover
number-length enforcement across asynchronous input chunks and rejection
of a case-insensitive protected-property bypass (#4152, #4153).
These changes remediate dependencies; an exploitable Ambari endpoint is not
claimed solely from library versions. Agent Configuration2's optional YAML
support is not packaged. The server's separate Hadoop-transitive
Configuration2 2.1.1 remains a follow-up, along with unrelated framework,
database, and frontend upgrades.
## How was this patch tested?
On macOS with JDK 17.0.19 and Maven 3.9.11, the combined focused lifecycle
passed **66 tests, zero failures/errors** (51 server, 15 agent):
```shell
env JAVA_HOME=/opt/homebrew/Cellar/openjdk@17/17.0.19/libexec/openjdk.jdk/Contents/Home /tmp/apache-maven-3.9.11/bin/mvn -B -ntp -pl ambari-server,ambari-agent -Dtest=CommonsBeanUtilsSecurityTest,JacksonSecurityTest,ClientConfigArchiveTest,ClientConfigResourceProviderTest,MpackResourceProviderTest,ExecutionCommandWrapperTest,BootStrapResourceTest,JsonRequestBodyParserTest,JsonSerializerTest,CredentialStoreCreateTest,ZkMigratorTest -DfailIfNoTests=false -DskipPythonTests=true test
```
The final dependency audit passed for server, agent, and utility. It confirms
BeanUtils 1.11.0, Compress 1.28.0, aligned Jackson 2.18.9 artifacts, agent
Configuration2 2.15.0, and no resolved Jettison:
```shell
env JAVA_HOME=/opt/homebrew/Cellar/openjdk@17/17.0.19/libexec/openjdk.jdk/Contents/Home /tmp/apache-maven-3.9.11/bin/mvn -B -ntp -pl ambari-server,ambari-agent,ambari-utility -DskipTests -Dscope=runtime '-Dincludes=commons-beanutils:commons-beanutils,org.codehaus.jettison:jettison,org.apache.commons:commons-compress,org.apache.commons:commons-configuration2,com.fasterxml.jackson.*:*' dependency:tree
```
The same compiled Jupiter security tests were also run against explicit old
and new library classpaths. BeanUtils 1.9.4 fails the enum protection test,
while 1.11.0 passes both tests. Jackson 2.18.2 fails both security assertions
but passes the valid-number control; 2.18.9 passes all three tests.
`git diff --check` passed. The five topic patches replay cleanly from trunk
474f6711c1 and reproduce the exact tested tree. Python tests were explicitly
skipped in successful runs: an initial attempt including Python failed when
a Linux cryptography native module was loaded on macOS. The full repository
suite and packaged deployment tests were not run.
Please review [Ambari Contributing Guide](https://cwiki.apache.org/confluence/display/AMBARI/How+to+Contribute) before opening a pull request.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ambari.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ambari.apache.org
For additional commands, e-mail: dev-help@ambari.apache.org
Re: [PR] AMBARI-26653: Remediate vulnerable runtime and build dependencies [ambari]
Posted by "JiaLiangC (via GitHub)" <gi...@apache.org>.
JiaLiangC merged PR #4208:
URL: https://github.com/apache/ambari/pull/4208
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ambari.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ambari.apache.org
For additional commands, e-mail: dev-help@ambari.apache.org