CalvinKirs opened a new pull request, #70109:
URL: https://github.com/apache/doris/pull/70109
### What problem does this PR solve?
Hadoop brings Kerby 2.0.3 into the FE dependency graph. Its ASN.1 parser can
overflow the stack on deeply nested input (CVE-2026-57914). Managing only
`kerb-core` and `kerb-simplekdc` does not align independently requested modules
such as `kerb-util`.
Import the official Kerby 2.1.2 BOM to align all seven resolved Kerby
runtime modules with the fixed ASN.1 parser. Add regression tests for definite-
and indefinite-length nesting, shallow ASN.1 values, and Hadoop reading a
Kerby-generated keytab.
Scope: this updates the standalone Kerby JARs. The relocated Kerby copy
inside `hadoop-client-runtime` requires a separate artifact update; this PR
does not claim to remove that copy or establish FE exploitability.
### Release note
Upgrade the FE's standalone Kerby dependencies to 2.1.2.
### Check List (For Author)
- Test
- [x] Unit Test: `mvn -pl fe-common -am test
-Dtest=HadoopKerberosDependencyTest -Dsurefire.failIfNoSpecifiedTests=false
-DfailIfNoTests=false` — 4 passed, none skipped; compiles `fe-foundation` and
`fe-common` and runs their validation checks.
- [x] Manual test: the same regression class against the previous 2.0.3
dependency classpath produced `StackOverflowError` for both deep nesting cases;
shallow parsing and keytab reading passed.
- [x] Manual test: `mvn -pl fe-core -am dependency:tree
'-Dincludes=org.apache.kerby:*' -Dscope=runtime -Dverbose` — the same seven
runtime modules now resolve to 2.1.2.
- [x] Manual test: `mvn -pl fe-core -am validate -DskipTests` — all 15
reactor projects pass, with no Checkstyle violations. Run Maven commands from
`fe/`.
- Behavior changed:
- [x] Yes. The upgraded ASN.1 parser rejects excessive nesting with
`IOException` instead of overflowing the stack; shallow values and Hadoop
keytab reading remain supported.
- Does this need documentation?
- [x] No.
### Check List (For Reviewer who merge this PR)
- [ ] Confirm the release note
- [ ] Confirm test cases
- [ ] Confirm document
- [ ] Add branch pick label
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
