[jira] [Created] (CASSANDRA-21676) Shaded cassandra-driver-core bundles Netty 4.1.94.Final and hides it from security scanners

["Éder Costa (Jira)" <ji...@apache.org>]

Éder Costa created CASSANDRA-21676:
--------------------------------------

             Summary: Shaded cassandra-driver-core bundles Netty 4.1.94.Final and hides it from security scanners
                 Key: CASSANDRA-21676
                 URL: https://issues.apache.org/jira/browse/CASSANDRA-21676
             Project: Apache Cassandra
          Issue Type: Bug
          Components: Dependencies
            Reporter: Éder Costa


Cassandra depends on org.apache.cassandra:cassandra-driver-core:3.12.1 with the "shaded" classifier. That artifact bundles a relocated copy of Netty 4.1.94.Final (released 2023-06-20) under com.datastax.shaded.netty, across eight Netty modules. Twelve published Netty advisories fall inside that version, ten of them in netty-handler and netty-codec.

The bigger problem is that this copy is invisible to dependency scanners. The driver's shade configuration uses DontIncludeResourceTransformer to delete the Maven descriptors of the bundled libraries, including netty-handler and netty-codec. Three descriptors were not listed and therefore survive: netty-resolver, netty-transport-classes-epoll and netty-transport-native-unix-common. Those three carry no advisory at all, so scanners report a clean result while the modules that matter cannot be detected. Consumers cannot work around this with a Maven exclusion, since an exclusion matches an artifact coordinate and these relocated classes were never published as an artifact.

Reproduction:

  curl -sO https://repo1.maven.org/maven2/org/apache/cassandra/cassandra-driver-core/3.12.1/cassandra-driver-core-3.12.1-shaded.jar

  # surviving descriptor shows the bundled version
  unzip -p cassandra-driver-core-3.12.1-shaded.jar META-INF/maven/io.netty/netty-resolver/pom.properties
  # -> version=4.1.94.Final

  # netty-handler has no descriptor, but its classes are there
  unzip -l cassandra-driver-core-3.12.1-shaded.jar 'META-INF/maven/io.netty/netty-handler/pom.*'
  unzip -l cassandra-driver-core-3.12.1-shaded.jar 'com/datastax/shaded/netty/handler/ssl/SslClientHelloHandler.class'

Related: CASSANDRA-19654 (update the bundled driver dependency, open since 2024-05-22) and CASSANDRA-20329 (move the driver to a tools-only dependency).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org