[jira] [Reopened] (KAFKA-14660) Divide by zero security vulnerability (sonatype-2019-0422)

["Andy Coates (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KAFKA-14660?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andy Coates reopened KAFKA-14660:
---------------------------------

The issue here is more the SonaType security vulnerability report than any impossible to reach divide by zero issue. Unfortunately, I'm struggling to find information on _how_ to mark the vulnerability resolved in SonaType.  This was why I was suggesting opening and merging the PR, as it seems the PR is the cause of the report.

I realise the PR's solution wasn't ideal. Hence I was suggesting to merge and put in a second change after to fix the fix, so to speak.

If you've already summited a fix for the DBZ, then I see two potential ways forward:
 # work out how to inform SonaType the issue is fixed:
 ## There is a [Report correction|https://ossindex.sonatype.org/doc/report-vulnerability] link on the bug report.  May you, or I if you let me know the PR you fixed the DBZ in, can use this to raise the fact its been fixed?
 ## Maybe just tagging the [SonaType issue|https://ossindex.sonatype.org/vulnerability/sonatype-2019-0422?component-type=maven&component-name=org.apache.kafka%2Fkafka-streams&utm_source=ossindex-client&utm_medium=integration&utm_content=1.7.0] in your PR would be enough?
 ## Does someone in Confluent know about this stuff that you can talk to?
 ## ????
 # reopen, 'adjust' and merge the original PR... hopefully triggering SonaType to mark the issue resolved.

> Divide by zero security vulnerability (sonatype-2019-0422)
> ----------------------------------------------------------
>
>                 Key: KAFKA-14660
>                 URL: https://issues.apache.org/jira/browse/KAFKA-14660
>             Project: Kafka
>          Issue Type: Bug
>          Components: streams
>    Affects Versions: 3.3.2
>            Reporter: Andy Coates
>            Assignee: Matthias J. Sax
>            Priority: Minor
>             Fix For: 3.5.0
>
>
> Looks like SonaType has picked up a "Divide by Zero" issue reported in a PR and, because the PR was never merged, is now reporting it as a security vulnerability in the latest Kafka Streams library.
>  
> See:
>  * [Vulnerability: sonatype-2019-0422]([https://ossindex.sonatype.org/vulnerability/sonatype-2019-0422?component-type=maven&component-name=org.apache.kafka%2Fkafka-streams&utm_source=ossindex-client&utm_medium=integration&utm_content=1.7.0)]
>  * [Original PR]([https://github.com/apache/kafka/pull/7414])
>  
> While it looks from the comments made by [~mjsax] and [~bbejeck] that the divide-by-zero is not really an issue, the fact that its now being reported as a vulnerability is, especially with regulators.
> PITA, but we should consider either getting this vulnerability removed (Google wasn't very helpful in providing info on how to do this), or fixed (Again, not sure how to tag the fix as fixing this issue).  One option may just be to reopen the PR and merge (and then fix forward by switching it to throw an exception).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)