You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@druid.apache.org by "tejaswini-imply (via GitHub)" <gi...@apache.org> on 2023/08/21 07:11:55 UTC
[PR] Fix reported CVEs (druid)
tejaswini-imply opened a new pull request, #14882:
URL: https://github.com/apache/druid/pull/14882
- Suppress CVEs from dependencies with no available fix or false positives
- `hadoop-annotations`: CVE-2022-25168, CVE-2021-33036
- `hadoop-client-runtime`: CVE-2023-1370, CVE-2023-37475
- `okio`: CVE-2023-3635
- Upgrade grpc version to fix CVE-2023-33953
- Drop `druid-iceberg-extensions` module
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] Fix reported CVEs (druid)
Posted by "abhishekagarwal87 (via GitHub)" <gi...@apache.org>.
abhishekagarwal87 commented on code in PR #14882:
URL: https://github.com/apache/druid/pull/14882#discussion_r1301227594
##########
distribution/pom.xml:
##########
@@ -448,8 +448,6 @@
<argument>org.apache.druid.extensions.contrib:aliyun-oss-extensions</argument>
<argument>-c</argument>
<argument>org.apache.druid.extensions.contrib:opentelemetry-emitter</argument>
- <argument>-c</argument>
- <argument>org.apache.druid.extensions:druid-iceberg-extensions</argument>
Review Comment:
why are you removing this? This profile is bundle-contrib-exts which is supposed to package all contrib extensions in the bundle.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] Fix reported CVEs (druid)
Posted by "abhishekagarwal87 (via GitHub)" <gi...@apache.org>.
abhishekagarwal87 commented on code in PR #14882:
URL: https://github.com/apache/druid/pull/14882#discussion_r1299797713
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -359,6 +359,9 @@
]]></notes>
<cve>CVE-2022-45855</cve>
<cve>CVE-2022-42009</cve>
+ <!-- Suppress hadoop CVEs that not applicable to hadoop-annotations -->
Review Comment:
we should add a comment as to why these are not applicable to hadoop-annotations.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] Fix reported CVEs (druid)
Posted by "abhishekagarwal87 (via GitHub)" <gi...@apache.org>.
abhishekagarwal87 merged PR #14882:
URL: https://github.com/apache/druid/pull/14882
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] Fix reported CVEs (druid)
Posted by "tejaswini-imply (via GitHub)" <gi...@apache.org>.
tejaswini-imply commented on code in PR #14882:
URL: https://github.com/apache/druid/pull/14882#discussion_r1300906517
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -359,6 +359,9 @@
]]></notes>
<cve>CVE-2022-45855</cve>
<cve>CVE-2022-42009</cve>
+ <!-- Suppress hadoop CVEs that not applicable to hadoop-annotations -->
Review Comment:
Updated it! Thanks, @abhishekagarwal87
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] Fix reported CVEs (druid)
Posted by "tejaswini-imply (via GitHub)" <gi...@apache.org>.
tejaswini-imply commented on code in PR #14882:
URL: https://github.com/apache/druid/pull/14882#discussion_r1301357136
##########
distribution/pom.xml:
##########
@@ -448,8 +448,6 @@
<argument>org.apache.druid.extensions.contrib:aliyun-oss-extensions</argument>
<argument>-c</argument>
<argument>org.apache.druid.extensions.contrib:opentelemetry-emitter</argument>
- <argument>-c</argument>
- <argument>org.apache.druid.extensions:druid-iceberg-extensions</argument>
Review Comment:
Reverted this! Thanks for pointing it out.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org