You are viewing a plain text version of this content. The canonical link for it is here.

Posted to notifications@skywalking.apache.org by GitBox <gi...@apache.org> on 2022/08/04 08:06:19 UTC

[GitHub] [skywalking-java] yoyofx opened a new pull request, #288: Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability

yoyofx opened a new pull request, #288:
URL: https://github.com/apache/skywalking-java/pull/288

   <!--
       ⚠️ Please make sure to read this template first, pull requests that don't accord with this template
       maybe closed without notice.
       Texts surrounded by `<` and `>` are meant to be replaced by you, e.g. <framework name>, <issue number>.
       Put an `x` in the `[ ]` to mark the item as CHECKED. `[x]`
   -->
   
   ### Fix CVE-2022-24823 and CVE-2022-25647 
   #### apm-network
   * io.netty:netty-codec-http2 │ CVE-2022-24823
   
   #### apm-sniffer/apm-agent-core
   * com.google.code.gson:gson | CVE-2022-25647
   
   #### apm-sniffer/apm-agent-core 
   #### apm-sniffer/optional-plugins/guava-cache-plugin
   #### test/plugin
   #### test/basse
   
   * guava.version:guava | CVE-2018-10237
   
   - [ ] Add a unit test to verify that the fix works.
   - [x] Explain briefly why the bug exists and how to fix it.
   
   
   
   <!-- ==== 🔌 Remove this line WHEN AND ONLY WHEN you're adding a new plugin, follow the checklist 👇 ====
   ### Add an agent plugin to support <framework name>
   - [ ] Add a test case for the new plugin, refer to [the doc](https://github.com/apache/skywalking-java/blob/main/docs/en/setup/service-agent/java-agent/Plugin-test.md)
   - [ ] Add a component id in [the component-libraries.yml](https://github.com/apache/skywalking/blob/master/oap-server/server-starter/src/main/resources/component-libraries.yml)
   - [ ] Add a logo in [the UI repo](https://github.com/apache/skywalking-rocketbot-ui/tree/master/src/views/components/topology/assets)
        ==== 🔌 Remove this line WHEN AND ONLY WHEN you're adding a new plugin, follow the checklist 👆 ==== -->
   
   <!-- ==== 📈 Remove this line WHEN AND ONLY WHEN you're improving the performance, follow the checklist 👇 ====
   ### Improve the performance of <class or module or ...>
   - [ ] Add a benchmark for the improvement, refer to [the existing ones](https://github.com/apache/skywalking-java/blob/main/apm-commons/apm-datacarrier/src/test/java/org/apache/skywalking/apm/commons/datacarrier/LinkedArrayBenchmark.java)
   - [ ] The benchmark result.
   ```text
   <Paste the benchmark results here>
   ```
   - [ ] Links/URLs to the theory proof or discussion articles/blogs. <links/URLs here>
        ==== 📈 Remove this line WHEN AND ONLY WHEN you're improving the performance, follow the checklist 👆 ==== -->
   
   <!-- ==== 🆕 Remove this line WHEN AND ONLY WHEN you're adding a new feature, follow the checklist 👇 ====
   ### <Feature description>
   - [ ] If this is non-trivial feature, paste the links/URLs to the design doc.
   - [ ] Update the documentation to include this new feature.
   - [ ] Tests(including UT, IT, E2E) are added to verify the new feature.
   - [ ] If it's UI related, attach the screenshots below.
        ==== 🆕 Remove this line WHEN AND ONLY WHEN you're adding a new feature, follow the checklist 👆 ==== -->
   
   - [ ] If this pull request closes/resolves/fixes an existing issue, replace the issue number. Closes #<issue number>.
   - [x] Update the [`CHANGES` log](https://github.com/apache/skywalking-java/blob/main/CHANGES.md).
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [skywalking-java] yoyofx commented on a diff in pull request #288: Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability

Posted by GitBox <gi...@apache.org>.

yoyofx commented on code in PR #288:
URL: https://github.com/apache/skywalking-java/pull/288#discussion_r937663085


##########
apm-protocol/apm-network/pom.xml:
##########
@@ -32,6 +32,11 @@
     </properties>
 
     <dependencies>
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-codec-http2</artifactId>
+            <version>${netty.version}</version>
+        </dependency>

Review Comment:
   Is resolve, another dependency of gRPC , that not dependency netty-codec-http2 . but it dependency
   netty-handler-proxy, that indirect dependency netty-codec-http2 for same version.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [skywalking-java] yoyofx commented on pull request #288: Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability

Posted by GitBox <gi...@apache.org>.

yoyofx commented on PR #288:
URL: https://github.com/apache/skywalking-java/pull/288#issuecomment-1204952461

   单独更新到 grpc最近版本  v1.48.1 也一样会依赖 netty-codec-http2<https://mvnrepository.com/artifact/io.netty/netty-codec-http2> 4.1.77.Final<https://mvnrepository.com/artifact/io.netty/netty-codec-http2/4.1.77.Final> ,并不能解决此问题
   
   参考资料:
   
   https://mvnrepository.com/artifact/io.grpc/grpc-netty/1.48.1
   
   Vulnerabilities from dependencies:
   CVE-2022-25647<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25647>
   
   https://mvnrepository.com/artifact/io.netty/netty-codec-http2/4.1.77.Final
   
   2022年8月4日 16:38，吴晟 Wu Sheng ***@***.***> 写道：
   
   
   
   @wu-sheng commented on this pull request.
   
   ________________________________
   
   In pom.xml<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fapache%2Fskywalking-java%2Fpull%2F288%23discussion_r937509836&data=05%7C01%7C%7C6e470719bbb94551840e08da75f4c4eb%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637951991387707957%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=kqpBHHe9jpfZ3Cye0sBhA8BeGvfFOyZqMVQ9YbV44qs%3D&reserved=0>:
   
   > @@ -88,7 +88,8 @@
            <!-- core lib dependency -->
            <bytebuddy.version>1.12.13</bytebuddy.version>
            <grpc.version>1.44.0</grpc.version>
   -        <gson.version>2.8.6</gson.version>
   +        <netty.version>4.1.79.Final</netty.version>
   
   
   Why do you set the netty version separately? Isn't bumping up grpc version working?
   
   —
   Reply to this email directly, view it on GitHub<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fapache%2Fskywalking-java%2Fpull%2F288%23pullrequestreview-1061504995&data=05%7C01%7C%7C6e470719bbb94551840e08da75f4c4eb%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637951991387707957%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=v7nEpLml3Kdel2%2FFZzAmgjMUGIjrBrKse8Wv0fO8y%2B8%3D&reserved=0>, or unsubscribe<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FABCL2FKBLP6HW42BNV2RVGLVXN6SBANCNFSM55RSDUWQ&data=05%7C01%7C%7C6e470719bbb94551840e08da75f4c4eb%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637951991387707957%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=bPrUhlNMALh6eOGMsoOXYm2waK2IPB4nQ7qt1ZzVD30%3D&reserved=0>.
   You are receiving this because you authored the thread.Message ID: ***@***.***>
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [skywalking-java] wu-sheng commented on pull request #288: Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability

Posted by GitBox <gi...@apache.org>.

wu-sheng commented on PR #288:
URL: https://github.com/apache/skywalking-java/pull/288#issuecomment-1204960915

   We need you to update all comments in English. This is a global community, we need to make sure all global users could understand what is going on, why we change.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [skywalking-java] wu-sheng commented on pull request #288: Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability

Posted by GitBox <gi...@apache.org>.

wu-sheng commented on PR #288:
URL: https://github.com/apache/skywalking-java/pull/288#issuecomment-1204943263

   All dependencies versions should be updated accordingly at here, https://github.com/apache/skywalking-java/blob/main/dist-material/LICENSE#L204


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [skywalking-java] wu-sheng commented on a diff in pull request #288: Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability

Posted by GitBox <gi...@apache.org>.

wu-sheng commented on code in PR #288:
URL: https://github.com/apache/skywalking-java/pull/288#discussion_r937508217


##########
CHANGES.md:
##########
@@ -12,7 +12,8 @@ Release Notes.
 * Add plugin to support Tomcat 10.x.
 * Save http status code regardless of it's status.
 * Upgrade byte-buddy to 1.12.13, and adopt byte-buddy APIs changes.
-
+* Upgrade gson to 2.8.9.
+* Upgrade netty-codec-http2 to 4.1.79.Final.
 #### Documentation

Review Comment:
   ```suggestion
   * Upgrade netty-codec-http2 to 4.1.79.Final.
   
   #### Documentation
   ```
   
   You missed one line here.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [skywalking-java] wu-sheng commented on a diff in pull request #288: Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability

Posted by GitBox <gi...@apache.org>.

wu-sheng commented on code in PR #288:
URL: https://github.com/apache/skywalking-java/pull/288#discussion_r937563343


##########
apm-protocol/apm-network/pom.xml:
##########
@@ -32,6 +32,11 @@
     </properties>
 
     <dependencies>
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-codec-http2</artifactId>
+            <version>${netty.version}</version>
+        </dependency>

Review Comment:
   This is still not resolved, there is another dependenc of gRPC in the pom.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [skywalking-java] wu-sheng commented on a diff in pull request #288: Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability

Posted by GitBox <gi...@apache.org>.

wu-sheng commented on code in PR #288:
URL: https://github.com/apache/skywalking-java/pull/288#discussion_r937532297


##########
apm-protocol/apm-network/pom.xml:
##########
@@ -32,6 +32,11 @@
     </properties>
 
     <dependencies>
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-codec-http2</artifactId>
+            <version>${netty.version}</version>
+        </dependency>

Review Comment:
   You add a `netty dependency`, but you never exclude netty dependency from gRPC dependency. 
   Also, grpc dependency is also existing in many other places.
   
   <img width="990" alt="image" src="https://user-images.githubusercontent.com/5441976/182807529-e0e41d91-309f-4f7b-b97d-f215c2f0045e.png">
   
   Especially agent-core pom.xml matters.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [skywalking-java] wu-sheng commented on a diff in pull request #288: Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability

Posted by GitBox <gi...@apache.org>.

wu-sheng commented on code in PR #288:
URL: https://github.com/apache/skywalking-java/pull/288#discussion_r937555910


##########
apm-sniffer/optional-plugins/guava-cache-plugin/pom.xml:
##########
@@ -31,7 +31,7 @@
     <modelVersion>4.0.0</modelVersion>
 
     <properties>
-        <guava-client.version>23.0</guava-client.version>
+        <guava-client.version>30.1.1-jre</guava-client.version>

Review Comment:
   Don't change the plugin dependency version. This is used for compiling only.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [skywalking-java] wu-sheng commented on pull request #288: Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability

Posted by GitBox <gi...@apache.org>.

wu-sheng commented on PR #288:
URL: https://github.com/apache/skywalking-java/pull/288#issuecomment-1205902634

   <img width="1440" alt="image" src="https://user-images.githubusercontent.com/5441976/182976086-4fcbe3d6-137d-4d32-b397-f0919a082d92.png">
   
   Confirmed, the agent's dependency changed.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [skywalking-java] wu-sheng commented on a diff in pull request #288: Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability

Posted by GitBox <gi...@apache.org>.

wu-sheng commented on code in PR #288:
URL: https://github.com/apache/skywalking-java/pull/288#discussion_r937585592


##########
apm-protocol/apm-network/pom.xml:
##########
@@ -52,11 +52,23 @@
             <groupId>io.grpc</groupId>
             <artifactId>grpc-protobuf</artifactId>
             <version>${grpc.version}</version>
+            <exclusions>
+                <exclusion>
+                    <artifactId>netty-codec-http2</artifactId>
+                    <groupId>io.netty</groupId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>io.grpc</groupId>
             <artifactId>grpc-stub</artifactId>
             <version>${grpc.version}</version>
+            <exclusions>
+                <exclusion>
+                    <artifactId>netty-codec-http2</artifactId>
+                    <groupId>io.netty</groupId>
+                </exclusion>
+            </exclusions>

Review Comment:
   I can't see `netty-codec-http2` in the dependency tree of this. Why do you do this?



##########
apm-protocol/apm-network/pom.xml:
##########
@@ -52,11 +52,23 @@
             <groupId>io.grpc</groupId>
             <artifactId>grpc-protobuf</artifactId>
             <version>${grpc.version}</version>
+            <exclusions>
+                <exclusion>
+                    <artifactId>netty-codec-http2</artifactId>
+                    <groupId>io.netty</groupId>
+                </exclusion>
+            </exclusions>

Review Comment:
   I can't see `netty-codec-http2` in the dependency tree of this. Why do you do this?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [skywalking-java] yoyofx commented on pull request #288: Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability

Posted by GitBox <gi...@apache.org>.

yoyofx commented on PR #288:
URL: https://github.com/apache/skywalking-java/pull/288#issuecomment-1205047730

   Excluded netty-codec-http2 from gRPC dependency from apm-agent-core and apm-network  in the POM.
   
   I can't find a another.
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [skywalking-java] wu-sheng merged pull request #288: Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability

Posted by GitBox <gi...@apache.org>.

wu-sheng merged PR #288:
URL: https://github.com/apache/skywalking-java/pull/288


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

[GitHub] [skywalking-java] wu-sheng commented on a diff in pull request #288: Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability

Posted by GitBox <gi...@apache.org>.

wu-sheng commented on code in PR #288:
URL: https://github.com/apache/skywalking-java/pull/288#discussion_r937509836


##########
pom.xml:
##########
@@ -88,7 +88,8 @@
         <!-- core lib dependency -->
         <bytebuddy.version>1.12.13</bytebuddy.version>
         <grpc.version>1.44.0</grpc.version>
-        <gson.version>2.8.6</gson.version>
+        <netty.version>4.1.79.Final</netty.version>

Review Comment:
   Why do you set the netty version separately? Isn't bumping up grpc version working?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org