This is an automated email from the ASF dual-hosted git repository.
yiguolei pushed a commit to branch branch-4.1
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/branch-4.1 by this push:
new e76101a8854 branch-4.1: [fix](fe) Upgrade vulnerable dependencies
(#67148)
e76101a8854 is described below
commit e76101a88545b0bbb09098867f63f2a6e4a54dd5
Author: Calvin Kirs <[email protected]>
AuthorDate: Mon Sep 7 09:20:21 2026 +0800
branch-4.1: [fix](fe) Upgrade vulnerable dependencies (#67148)
#67000
---
fe/fe-core/pom.xml | 16 ++++++++
fe/hive-udf/pom.xml | 1 -
fe/pom.xml | 104 ++++++++++++++++++++++++++++++++++++++++++++++++----
3 files changed, 112 insertions(+), 9 deletions(-)
diff --git a/fe/fe-core/pom.xml b/fe/fe-core/pom.xml
index 2a0cc1d8224..ef7b93414ef 100644
--- a/fe/fe-core/pom.xml
+++ b/fe/fe-core/pom.xml
@@ -372,6 +372,12 @@ under the License.
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-jetty</artifactId>
</dependency>
+ <!-- Jetty 12.0.38 calls Jakarta Servlet 6.1 APIs when writing
Set-Cookie headers. -->
+ <dependency>
+ <groupId>jakarta.servlet</groupId>
+ <artifactId>jakarta.servlet-api</artifactId>
+ <version>${jakarta.servlet-api.version}</version>
+ </dependency>
<!-- File Upload -->
<dependency>
<groupId>commons-fileupload</groupId>
@@ -420,6 +426,10 @@ under the License.
<groupId>com.huaweicloud.sdk</groupId>
<artifactId>huaweicloud-sdk-iam</artifactId>
<exclusions>
+ <exclusion>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>bcprov-jdk15on</artifactId>
+ </exclusion>
<exclusion>
<groupId>com.squareup.okhttp3</groupId>
<artifactId>okhttp</artifactId>
@@ -430,6 +440,12 @@ under the License.
</exclusion>
</exclusions>
</dependency>
+ <!-- Replace Huawei IAM's bcprov-jdk15on 1.69/1.70 with 1.84 from the
maintained
+ jdk18on line; it fixes CVE-2023-33202 and the later 2025/2026 BC
Java advisories. -->
+ <dependency>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>bcprov-jdk18on</artifactId>
+ </dependency>
<!-- ICU4J for unicode normalization -->
<dependency>
<groupId>com.ibm.icu</groupId>
diff --git a/fe/hive-udf/pom.xml b/fe/hive-udf/pom.xml
index a30a2a5ac6f..83bb1f7c42f 100644
--- a/fe/hive-udf/pom.xml
+++ b/fe/hive-udf/pom.xml
@@ -119,7 +119,6 @@ under the License.
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-shade-plugin</artifactId>
- <version>3.6.0</version>
<configuration>
<minimizeJar>true</minimizeJar>
<relocations>
diff --git a/fe/pom.xml b/fe/pom.xml
index 9e63c98bdac..d1a7ece5d31 100644
--- a/fe/pom.xml
+++ b/fe/pom.xml
@@ -205,6 +205,11 @@ under the License.
</execution>
</executions>
</plugin>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-shade-plugin</artifactId>
+ <version>${maven-shade-plugin.version}</version>
+ </plugin>
</plugins>
</pluginManagement>
<extensions>
@@ -267,9 +272,16 @@ under the License.
<commons-validator.version>1.9.0</commons-validator.version>
<gson.version>2.10.1</gson.version>
<guava.version>33.2.1-jre</guava.version>
- <jackson.version>2.16.0</jackson.version>
+ <!-- Jackson 2.16.0 is affected by multiple 2026 parser and
polymorphic-deserialization
+ vulnerabilities, including CVE-2026-54512. Version 2.21.5
contains the complete fixes. -->
+ <jackson.version>2.21.5</jackson.version>
<javassist.version>3.18.2-GA</javassist.version>
<javax.servlet-api.version>3.1.0</javax.servlet-api.version>
+ <!-- Jetty 12.0.38 (jetty-ee10-servlet) invokes
jakarta.servlet.http.Cookie#getAttributes(),
+ which only exists since Jakarta Servlet 6.1. Pin the API to 6.1.0
so it matches the
+ jetty version; otherwise the transitive 6.0.0 from spring-boot
triggers NoSuchMethodError
+ when the FE HTTP server writes a Set-Cookie (SameSite) header. -->
+ <jakarta.servlet-api.version>6.1.0</jakarta.servlet-api.version>
<je.version>18.3.14-doris-SNAPSHOT</je.version>
<jmockit.version>1.49</jmockit.version>
<commons-io.version>2.18.0</commons-io.version>
@@ -287,6 +299,9 @@ under the License.
<resilience4j.version>2.4.0</resilience4j.version>
<!-- Keep Netty compatible with Arrow Flight SQL 19 and other
transitive Netty users. -->
<netty-all.version>4.2.15.Final</netty-all.version>
+ <!-- OpenTelemetry versions before 1.62.0 allow unbounded allocation
while parsing W3C
+ baggage (CVE-2026-45292); align the complete OpenTelemetry graph
on the fixed BOM. -->
+ <opentelemetry.version>1.62.0</opentelemetry.version>
<!--The dependence of transitive dependence cannot be ruled out, only
Saving the nation through twisted ways.-->
<netty-3-test.version>3.10.6.Final</netty-3-test.version>
<objenesis.version>2.1</objenesis.version>
@@ -355,6 +370,11 @@ under the License.
<hamcrest.version>2.1</hamcrest.version>
<httpclient.version>4.5.13</httpclient.version>
<httpcore.version>4.4.15</httpcore.version>
+ <!-- HttpClient 5.5.2 can leak pooled connections on decode errors
(CVE-2026-64607),
+ and HttpCore 5.3.6 is affected by HTTP/1 and HTTP/2
memory-exhaustion issues
+ (CVE-2026-54399 and CVE-2026-54428). Use their fixed maintenance
releases. -->
+ <httpclient5.version>5.6.3</httpclient5.version>
+ <httpcore5.version>5.4.3</httpcore5.version>
<aws-java-sdk.version>1.12.669</aws-java-sdk.version>
<mariadb-java-client.version>3.0.9</mariadb-java-client.version>
<postgresql.version>42.7.13</postgresql.version>
@@ -368,18 +388,32 @@ under the License.
<antlr4.version>4.13.1</antlr4.version>
<joda.version>2.8.1</joda.version>
<project.scm.id>github</project.scm.id>
- <spring.version>3.5.14</spring.version>
- <spring-framework.version>6.2.18</spring-framework.version>
+ <!-- Spring Boot 3.5.16 manages fixed Spring LDAP 3.3.8, Spring Data
3.5.13,
+ Micrometer 1.15.12, and Logback 1.5.34 releases for their 2026
advisories. -->
+ <spring.version>3.5.16</spring.version>
+ <!-- Spring Framework 6.2.19 fixes the June 2026 security advisory
set, including
+ CVE-2026-41848; keep the explicit framework BOM aligned with that
release. -->
+ <spring-framework.version>6.2.19</spring-framework.version>
<orc.version>1.8.4</orc.version>
<zookeeper.version>3.9.3</zookeeper.version>
<velocity-engine-core.version>2.4</velocity-engine-core.version>
<ranger-plugins-common.version>2.8.0</ranger-plugins-common.version>
- <bcprov-jdk15on.version>1.70</bcprov-jdk15on.version>
+ <!-- Huawei IAM pulls bcprov-jdk15on 1.69, whose final 1.70 release is
vulnerable to
+ CVE-2023-33202. Use the compatible jdk18on line at 1.84, which
also fixes
+ CVE-2025-14813, CVE-2026-0636, CVE-2026-3505, CVE-2026-5588, and
CVE-2026-5598. -->
+ <bcprov-jdk18on.version>1.84</bcprov-jdk18on.version>
<woodstox.version>6.5.1</woodstox.version>
<kerby.version>2.0.3</kerby.version>
<jettison.version>1.5.4</jettison.version>
- <jetty.version>12.0.29</jetty.version>
+ <!-- Jetty 12.0.34 is affected by CVE-2026-6790, CVE-2026-8384,
+ CVE-2026-10050, and CVE-2026-10051; 12.0.38 contains all
published fixes. -->
+ <jetty.version>12.0.38</jetty.version>
<jetty-http.version>11.0.26</jetty-http.version>
+ <!-- org.lz4:lz4-java is archived and vulnerable through its final
1.8.x line.
+ Resolve its official 1.8.1 relocation POM, then manage the
maintained coordinate at
+ 1.11.1 to fix CVE-2025-12183, CVE-2025-66566, and CVE-2026-59949.
-->
+ <lz4-java-relocation.version>1.8.1</lz4-java-relocation.version>
+ <lz4-java.version>1.11.1</lz4-java.version>
<immutables.version>2.9.3</immutables.version>
<ivy.version>2.5.2</ivy.version>
<icu4j.version>78.1</icu4j.version>
@@ -394,6 +428,10 @@ under the License.
<arrow.vector.classifier>shade-format-flatbuffers</arrow.vector.classifier>
<flatbuffers.version>1.12.0</flatbuffers.version>
<jacoco.version>0.8.10</jacoco.version>
+ <!-- Maven Shade 3.4.1 cannot parse the Java 21 multi-release classes
shipped by
+ Jackson 2.21.x. Version 3.6.2 uses a current ASM release that
supports them. -->
+ <maven-shade-plugin.version>3.6.2</maven-shade-plugin.version>
+ <argLine></argLine>
<trino.version>435</trino.version>
<nimbusds.version>10.0.1</nimbusds.version>
<jakarta.annotation-api.version>2.1.1</jakarta.annotation-api.version>
@@ -461,6 +499,14 @@ under the License.
<type>pom</type>
<scope>import</scope>
</dependency>
+ <!-- Keep all OpenTelemetry API, SDK, and exporter artifacts on
the CVE-2026-45292-fixed line. -->
+ <dependency>
+ <groupId>io.opentelemetry</groupId>
+ <artifactId>opentelemetry-bom</artifactId>
+ <version>${opentelemetry.version}</version>
+ <type>pom</type>
+ <scope>import</scope>
+ </dependency>
<dependency>
<groupId>com.fasterxml.jackson</groupId>
<artifactId>jackson-bom</artifactId>
@@ -468,6 +514,33 @@ under the License.
<scope>import</scope>
<type>pom</type>
</dependency>
+ <!-- Override Spring Boot's vulnerable HttpComponents 5 versions.
-->
+ <dependency>
+ <groupId>org.apache.httpcomponents.client5</groupId>
+ <artifactId>httpclient5</artifactId>
+ <version>${httpclient5.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.httpcomponents.core5</groupId>
+ <artifactId>httpcore5</artifactId>
+ <version>${httpcore5.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.httpcomponents.core5</groupId>
+ <artifactId>httpcore5-h2</artifactId>
+ <version>${httpcore5.version}</version>
+ </dependency>
+ <!-- First redirect archived org.lz4 dependencies, then select the
fixed maintained release. -->
+ <dependency>
+ <groupId>org.lz4</groupId>
+ <artifactId>lz4-java</artifactId>
+ <version>${lz4-java-relocation.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>at.yawk.lz4</groupId>
+ <artifactId>lz4-java</artifactId>
+ <version>${lz4-java.version}</version>
+ </dependency>
<dependency>
<groupId>org.apache.ivy</groupId>
<artifactId>ivy</artifactId>
@@ -508,6 +581,15 @@ under the License.
<scope>import</scope>
<type>pom</type>
</dependency>
+ <!-- The core Jetty BOM does not manage Jakarta EE 10 artifacts;
import the matching
+ EE10 BOM before Spring Boot so the complete Jetty 12 graph
stays on 12.0.38. -->
+ <dependency>
+ <groupId>org.eclipse.jetty.ee10</groupId>
+ <artifactId>jetty-ee10-bom</artifactId>
+ <version>${jetty.version}</version>
+ <scope>import</scope>
+ <type>pom</type>
+ </dependency>
<dependency>
<groupId>org.eclipse.jetty.http2</groupId>
<artifactId>http2-client</artifactId>
@@ -613,11 +695,11 @@ under the License.
<artifactId>woodstox-core</artifactId>
<version>${woodstox.version}</version>
</dependency>
- <!-- bcprov-jdk15on -->
+ <!-- Replacement for Huawei IAM's vulnerable bcprov-jdk15on
dependency. -->
<dependency>
<groupId>org.bouncycastle</groupId>
- <artifactId>bcprov-jdk15on</artifactId>
- <version>${bcprov-jdk15on.version}</version>
+ <artifactId>bcprov-jdk18on</artifactId>
+ <version>${bcprov-jdk18on.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
@@ -1813,6 +1895,12 @@ under the License.
<groupId>com.squareup.okio</groupId>
<artifactId>okio</artifactId>
</exclusion>
+ <!-- Trino 435 pulls a Servlet 5.0 API repackage that
shadows Jakarta Servlet
+ 6.1 on the FE classpath and breaks Jetty 12.0.38
cookie handling. -->
+ <exclusion>
+ <groupId>org.eclipse.jetty.toolchain</groupId>
+ <artifactId>jetty-jakarta-servlet-api</artifactId>
+ </exclusion>
</exclusions>
</dependency>
<dependency>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
