Éder Costa created CASSANDRA-21676:
--------------------------------------
Summary: Shaded cassandra-driver-core bundles Netty 4.1.94.Final
and hides it from security scanners
Key: CASSANDRA-21676
URL: https://issues.apache.org/jira/browse/CASSANDRA-21676
Project: Apache Cassandra
Issue Type: Bug
Components: Dependencies
Reporter: Éder Costa
Cassandra depends on org.apache.cassandra:cassandra-driver-core:3.12.1 with the
"shaded" classifier. That artifact bundles a relocated copy of Netty
4.1.94.Final (released 2023-06-20) under com.datastax.shaded.netty, across
eight Netty modules. Twelve published Netty advisories fall inside that
version, ten of them in netty-handler and netty-codec.
The bigger problem is that this copy is invisible to dependency scanners. The
driver's shade configuration uses DontIncludeResourceTransformer to delete the
Maven descriptors of the bundled libraries, including netty-handler and
netty-codec. Three descriptors were not listed and therefore survive:
netty-resolver, netty-transport-classes-epoll and
netty-transport-native-unix-common. Those three carry no advisory at all, so
scanners report a clean result while the modules that matter cannot be
detected. Consumers cannot work around this with a Maven exclusion, since an
exclusion matches an artifact coordinate and these relocated classes were never
published as an artifact.
Reproduction:
curl -sO
https://repo1.maven.org/maven2/org/apache/cassandra/cassandra-driver-core/3.12.1/cassandra-driver-core-3.12.1-shaded.jar
# surviving descriptor shows the bundled version
unzip -p cassandra-driver-core-3.12.1-shaded.jar
META-INF/maven/io.netty/netty-resolver/pom.properties
# -> version=4.1.94.Final
# netty-handler has no descriptor, but its classes are there
unzip -l cassandra-driver-core-3.12.1-shaded.jar
'META-INF/maven/io.netty/netty-handler/pom.*'
unzip -l cassandra-driver-core-3.12.1-shaded.jar
'com/datastax/shaded/netty/handler/ssl/SslClientHelloHandler.class'
Related: CASSANDRA-19654 (update the bundled driver dependency, open since
2024-05-22) and CASSANDRA-20329 (move the driver to a tools-only dependency).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
