This is an automated email from the ASF dual-hosted git repository.
CalvinKirs pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new efa3748b9ed [chore](deps) Upgrade vulnerable FE dependencies (#65700)
efa3748b9ed is described below
commit efa3748b9edfd3cd954eaa76308996eb7f04395f
Author: Calvin Kirs <[email protected]>
AuthorDate: Mon Jul 27 20:26:16 2026 +0800
[chore](deps) Upgrade vulnerable FE dependencies (#65700)
### What problem does this PR solve?
Issue Number: None
Related PR: None
Problem Summary:
This PR upgrades FE dependencies that are directly controlled by the
Maven POMs and were reported with CVEs by dependency-check on the
`rich/master` baseline.
Upgraded because dependency-check reported CVEs:
- `commons-configuration2` `2.11.0` -> `2.15.1` (CVE-2026-45205, MEDIUM)
- `postgresql` `42.7.3` -> `42.7.13` (CVE-2026-42198, HIGH)
Required companion upgrade (not a CVE fix):
- `commons-text` `1.10.0` -> `1.15.0`
`commons-configuration2:2.15.1` is compiled against
`commons-text:1.15.0` and its
`org.apache.commons.configuration2.interpol.StringLookupAdapter` calls
`StringLookup.apply(String)`. That method only exists once
`StringLookup` extends
`UnaryOperator` (1.15.0); `commons-text:1.10.0` declares
`lookup(String)` only.
Leaving Text pinned at 1.10.0 would therefore make any interpolation
path that goes
through `StringLookupAdapter` (e.g. Hadoop `MetricsConfig` resolving
`${sys:user.home}`)
fail with `NoSuchMethodError` at runtime. 1.15.0 still contains the
Text4Shell
(CVE-2022-42889) fix that 1.10.0 was originally pinned for, so this is
not a CVE regression.
Notable upstream behavior change (documented, no Doris code change):
- `commons-configuration2:2.15.1` adds a URL-scheme allow-list to
file/URL location loading.
`AbstractFileLocationStrategy` now defaults `DEFAULT_SCHEMES` to
`file,jar` and rejects any
other scheme with `ConfigurationDeniedException` (complete overridable
set: `file,http,https,jar`).
This is an upstream security hardening (mitigates loading configuration
from arbitrary remote
URLs). A configuration that pulls a remote include over `http`/`https`
-- e.g. a Hadoop
`hadoop-metrics2*.properties` with `include = https://...` -- will now
fail to load by default.
Doris does not ship such a configuration, so there is no expected
impact; a deployment that
genuinely relied on remote includes can restore the old behavior with
the system property
`-Dorg.apache.commons.configuration2.io.FileLocationStrategy.schemes=file,http,https,jar`.
We deliberately do not re-open `http`/`https` by default, as that would
undo the upstream fix.
Deliberately NOT changed:
- `dev.cel` stays at `0.12.0`. An earlier revision of this PR bumped it
to `0.13.1`, but
dependency-check reports **zero** vulnerabilities for `cel-0.12.0.jar`
(no suppressions), and
there is no published CVE/GHSA for `dev.cel` / `cel-java`. The bump
carried real risk for no
security benefit: `0.13.1` ships a new `dev.cel.runtime.planner`
evaluation engine and can
broaden the accepted CEL dialect, which matters because `RoleMappingMgr`
validates a mapping
only on the creating FE and journals the source expression, while replay
stores it without
compiling and `DefinitionBackedRoleMappingEvaluator` recompiles it
lazily at authentication
time. During a mixed-version rollout that could turn into an
authentication failure on a
not-yet-upgraded FE. Reverting the bump removes that exposure entirely.
- Azure SDK components are left at the versions managed by
`azure-sdk-bom` `1.3.7`. An earlier
revision overrode `azure-core`/`azure-core-http-netty`/`azure-identity`
to newer patch levels,
but BOM `1.3.7` already manages `azure-core 1.58.0`, `azure-identity
1.18.3` and
`azure-security-keyvault-keys 4.10.7` -- all at or above their fixed
versions -- and no FE
module declares `azure-security-keyvault-keys` (the artifact
CVE-2026-33117 affects). The
overrides therefore remediated no shipped vulnerable coordinate and only
added BOM skew, so
they were dropped.
The refreshed dependency-check JSON no longer contains the old direct
vulnerable coordinates
`[email protected]` or `[email protected]`. Some remaining
findings are still
reported for shaded/bundled dependencies or CPE matches that are not
safely removable through
a small POM-only change.
### Release note
None
### Check List (For Author)
- Test:
- `env DORIS_THIRDPARTY=/mnt/disk1/gq/idea/thirdparty mvn -pl fe-core
-am install -DskipTests -Dskip.doc=true
-Dmaven.build.cache.enabled=false`
- `mvn org.owasp:dependency-check-maven:12.2.0:aggregate -Dformat=ALL
-DfailBuildOnCVSS=11 -DfailOnError=false -DnvdApiServerId=nvd-api-key
-DnvdValidForHours=2160 -Dmaven.build.cache.enabled=false
-DyarnAuditAnalyzerEnabled=false -DretireJsAnalyzerEnabled=false
-DassemblyAnalyzerEnabled=false -DnugetconfAnalyzerEnabled=false
-DnuspecAnalyzerEnabled=false -DskipTests`
- Behavior changed: Only an upstream commons-configuration2 URL-scheme
allow-list (documented above); no Doris-side behavior change and no
default configuration ships a remote include.
- Does this need documentation: No
---
fe/fe-core/pom.xml | 2 +-
fe/pom.xml | 5 +++--
2 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/fe/fe-core/pom.xml b/fe/fe-core/pom.xml
index 431a9459e36..a942e027fc1 100644
--- a/fe/fe-core/pom.xml
+++ b/fe/fe-core/pom.xml
@@ -631,7 +631,7 @@ under the License.
<dependency>
<groupId>org.postgresql</groupId>
<artifactId>postgresql</artifactId>
- <version>42.7.3</version>
+ <version>${postgresql.version}</version>
<scope>provided</scope>
</dependency>
<dependency>
diff --git a/fe/pom.xml b/fe/pom.xml
index fb9b8088f69..5c0c92e89b4 100644
--- a/fe/pom.xml
+++ b/fe/pom.xml
@@ -264,13 +264,13 @@ under the License.
<cglib.version>2.2</cglib.version>
<commons-cli.version>1.4</commons-cli.version>
<commons-filerupload.version>1.6.0</commons-filerupload.version>
- <commons-configuration2.version>2.11.0</commons-configuration2.version>
+ <commons-configuration2.version>2.15.1</commons-configuration2.version>
<commons-codec.version>1.13</commons-codec.version>
<commons-lang3.version>3.19.0</commons-lang3.version>
<commons-net.version>3.13.0</commons-net.version>
<commons-pool2.version>2.2</commons-pool2.version>
<commons-pool.version>1.5.1</commons-pool.version>
- <commons-text.version>1.10.0</commons-text.version>
+ <commons-text.version>1.15.0</commons-text.version>
<commons-math3.version>3.6.1</commons-math3.version>
<commons-validator.version>1.9.0</commons-validator.version>
<gson.version>2.10.1</gson.version>
@@ -361,6 +361,7 @@ under the License.
<httpcore.version>4.4.15</httpcore.version>
<aws-java-sdk.version>1.12.669</aws-java-sdk.version>
<mariadb-java-client.version>3.0.9</mariadb-java-client.version>
+ <postgresql.version>42.7.13</postgresql.version>
<hadoop.version>3.4.2</hadoop.version>
<re2j.version>1.8</re2j.version>
<hadoop.thirdparty.guava.version>1.2.0</hadoop.thirdparty.guava.version>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
