Re: [I] CVEs detected in dependencies of pinot-java-client and pinot-common [pinot]

["robertzych (via GitHub)" <gi...@apache.org>]

robertzych commented on issue #12341:
URL: https://github.com/apache/pinot/issues/12341#issuecomment-1924921750

   The only dependency that had to be whitelisted was avatica-core 1.24.0 as it couldn't be excluded without introducing a regression. It's CVE ([CVE-2022-39135](https://nvd.nist.gov/vuln/detail/CVE-2022-39135)) doesn't apply.
   
   Here are the upgrades and exclusions I had to address all of the other CVEs:
   ```
         <dependency>
           <groupId>org.apache.pinot</groupId>
           <artifactId>pinot-java-client</artifactId>
           <version>1.0.0-hotfix</version>
           <exclusions>
             <exclusion>
               <groupId>org.apache.calcite.avatica</groupId>
               <artifactId>avatica-metrics</artifactId>
             </exclusion>
             <exclusion>
               <groupId>org.apache.calcite.avatica</groupId>
               <artifactId>avatica-core</artifactId>
             </exclusion>
             <exclusion>
               <groupId>org.apache.logging.log4j</groupId>
               <artifactId>log4j-1.2-api-2.17</artifactId>
             </exclusion>
             <exclusion>
               <groupId>com.typesafe.netty</groupId>
               <artifactId>netty-reactive-streams</artifactId>
             </exclusion>
             <exclusion>
               <groupId>org.apache.calcite</groupId>
               <artifactId>calcite-babel</artifactId>
             </exclusion>
             <exclusion>
               <groupId>org.apache.logging.log4j</groupId>
               <artifactId>log4j-1.2-api</artifactId>
             </exclusion>
           </exclusions>
         </dependency>
         <dependency>
           <groupId>com.google.guava</groupId>
           <artifactId>guava</artifactId>
           <version>32.1.3-jre</version>
           <exclusions>
             <exclusion>
               <groupId>com.google.guava</groupId>
               <artifactId>failureaccess</artifactId>
             </exclusion>
           </exclusions>
         </dependency>
         <dependency>
           <groupId>org.apache.calcite</groupId>
           <artifactId>calcite-core</artifactId>
           <version>1.36.0</version>
           <exclusions>
             <exclusion>
               <groupId>org.apache.calcite.avatica</groupId>
               <artifactId>avatica-metrics</artifactId>
             </exclusion>
             <exclusion>
               <groupId>org.apache.calcite.avatica</groupId>
               <artifactId>avatica-core</artifactId>
             </exclusion>
           </exclusions>
         </dependency>
         <dependency>
           <groupId>org.apache.helix</groupId>
           <artifactId>helix-core</artifactId>
           <version>1.3.0</version>
         </dependency>
         <dependency>
           <groupId>org.apache.calcite.avatica</groupId>
           <artifactId>avatica-core</artifactId>
           <version>1.24.0</version>
           <exclusions>
             <exclusion>
               <groupId>org.apache.calcite.avatica</groupId>
               <artifactId>avatica-metrics</artifactId>
             </exclusion>
           </exclusions>
         </dependency>
         <dependency>
           <groupId>net.minidev</groupId>
           <artifactId>json-smart</artifactId>
           <version>2.4.10</version>
         </dependency>
   ```
         


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pinot.apache.org
For additional commands, e-mail: commits-help@pinot.apache.org