Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE patches #5034

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

CVE patches #5034

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0549a5d
patch various CVEs
Dec 11, 2020
19ec479
Merge branch 'master' into cve-patches
bdoyle0182 Jan 31, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions common/scala/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,6 +104,38 @@ dependencies {
api ("com.azure:azure-storage-blob:12.7.0") {
exclude group: "com.azure", module: "azure-core-test"
}

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand the reason for these new dependencies being introduced here.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

They appear to be transitive dependencies from actual dependencies we declare.

I started this pr yesterday to clear all known CVE's before realizing this one existed. I think we can upgrade the actual dependencies rather than pin transitive dependencies. I'll take what I can from here, but I'm probably going to do things in multiple PR's so I'm not disrupting too much at once until I have cleared everything. I would much rather upgrade dependencies where I can and then pin transitive dependency versions as a last resort.

#5373

// https://nvd.nist.gov/vuln/detail/CVE-2015-5237
compile "com.google.protobuf:protobuf-java:${gradle.protobuf.version}"
compile "com.google.protobuf:protobuf-java-util:${gradle.protobuf.version}"

// https://nvd.nist.gov/vuln/detail/CVE-2017-18640
compile "org.yaml:snakeyaml:1.27"

// https://nvd.nist.gov/vuln/detail/CVE-2018-8023
compile "org.apache.mesos:mesos:1.4.3"

// https://nvd.nist.gov/vuln/detail/CVE-2018-20200
compile "com.squareup.okhttp3:okhttp:3.12.12"

// https://nvd.nist.gov/vuln/detail/CVE-2020-7014
compile "org.elasticsearch.client:elasticsearch-rest-client:6.8.13"

// https://nvd.nist.gov/vuln/detail/CVE-2020-11612
compile "io.netty:netty-buffer:${gradle.netty.version}"
compile "io.netty:netty-handler:${gradle.netty.version}"
compile "io.netty:netty-handler-proxy:${gradle.netty.version}"
compile "io.netty:netty-codec-socks:${gradle.netty.version}"
compile "io.netty:netty-codec-http:${gradle.netty.version}"
compile "io.netty:netty-codec-http2:${gradle.netty.version}"
compile "io.netty:netty-transport-native-epoll:${gradle.netty.version}"
compile "io.netty:netty-transport-native-unix-common:${gradle.netty.version}"

// https://nvd.nist.gov/vuln/detail/CVE-2020-13956
compile "org.apache.httpcomponents:httpclient:4.5.13"

// https://nvd.nist.gov/vuln/detail/CVE-2020-25649
compile "com.fasterxml.jackson.core:jackson-databind:2.10.5.1"
}

configurations {
Expand Down
4 changes: 3 additions & 1 deletion core/invoker/build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,9 @@ dependencies {
implementation ("org.apache.curator:curator-recipes:${gradle.curator.version}") {
exclude group: 'org.apache.zookeeper', module:'zookeeper'
}
implementation ("org.apache.zookeeper:zookeeper:3.4.11") {

// https://nvd.nist.gov/vuln/detail/CVE-2019-0201
implementation ("org.apache.zookeeper:zookeeper:3.4.14") {
exclude group: 'org.slf4j'
exclude group: 'log4j'
exclude group: 'jline'
Expand Down
2 changes: 2 additions & 0 deletions settings.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,4 +79,6 @@ gradle.ext.akka_http = [version : '10.2.4']
gradle.ext.akka_management = [version : '1.0.5']

gradle.ext.curator = [version : '4.0.0']
gradle.ext.netty = [version : '4.1.55.Final']
gradle.ext.protobuf = [version : '3.14.0']
gradle.ext.kube_client = [version: '4.10.3']