gianm commented on code in PR #20236: URL: https://github.com/apache/druid/pull/20236#discussion_r3962161534
########## owasp-dependency-check-suppressions.xml: ########## @@ -19,6 +19,52 @@ --> <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd";> <!-- False positives --> + + <!-- + elasticache-java-cluster-client-1.2.4.jar is Amazon's Java client for ElastiCache (Memcached). + It wraps spymemcached and adds auto-discovery. Druid uses it as a Memcached CLIENT only — + it sends get/set/delete commands to a remote Memcached server. Druid does NOT run a Memcached server. + + The CVE scanner matches the JAR version "1.2.4" against CPE cpe:2.3:a:memcached:memcached:1.2.4 + (the C memcached server daemon), which is a false positive. All CVEs below are vulnerabilities + in the Memcached server daemon (C code: memcached.c, items.c, etc.) and are not applicable to + a Java application acting as a Memcached client. + --> + <suppress> + <notes><![CDATA[ + file name: elasticache-java-cluster-client-1.2.4.jar + + All CVEs below affect the Memcached SERVER daemon (C code), not any Java client library. + Druid uses elasticache-java-cluster-client solely as a Memcached client to send cache + get/set/delete commands. Druid does not run or embed a Memcached server process. + + The version string "1.2.4" of the Java client JAR is incorrectly matched by the scanner + against CPE cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server), causing false positives. Review Comment: Is there a way we can deal with this by fixing the scanner rather than adding individual CVE suppressions? Like, can we exclude `memcached:memcached`? ########## owasp-dependency-check-suppressions.xml: ########## @@ -768,4 +869,156 @@ <packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl> <cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go (google.golang.org/grpc < 1.79.3), not gRPC Java - https://nvd.nist.gov/vuln/detail/CVE-2026-33186 --> </suppress> + + <suppress> + <!-- False positive: the scanner matches the Java client version 1.2.4 against + cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon). + com.amazonaws:elasticache-java-cluster-client is a Java Memcached client + library; all CVEs below are vulnerabilities in the Memcached server C code. + Druid acts as a Memcached client and is not affected by server-side CVEs. --> + <notes><![CDATA[ + file name: elasticache-java-cluster-client-1.2.4.jar Review Comment: Why do we need to list the elasticache false positives in two separate `<suppress>` blocks? Can they be put into a single block? ########## owasp-dependency-check-suppressions.xml: ########## @@ -768,4 +869,156 @@ <packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl> <cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go (google.golang.org/grpc < 1.79.3), not gRPC Java - https://nvd.nist.gov/vuln/detail/CVE-2026-33186 --> </suppress> + + <suppress> + <!-- False positive: the scanner matches the Java client version 1.2.4 against + cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon). + com.amazonaws:elasticache-java-cluster-client is a Java Memcached client + library; all CVEs below are vulnerabilities in the Memcached server C code. + Druid acts as a Memcached client and is not affected by server-side CVEs. --> + <notes><![CDATA[ + file name: elasticache-java-cluster-client-1.2.4.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/com\.amazonaws/elasticache-java-cluster-client@.*$</packageUrl> + <cve>CVE-2019-11596</cve> <!-- NULL ptr deref in memcached server daemon (memcached.c lru mode command) --> + <cve>CVE-2026-47784</cve> <!-- SASL password timing side-channel in memcached server daemon --> + <cve>CVE-2026-47783</cve> <!-- SASL username timing side-channel in memcached server daemon --> + <cve>CVE-2016-8705</cve> <!-- Integer overflow in memcached server daemon (process_bin_update) --> + <cve>CVE-2016-8706</cve> <!-- Integer overflow in memcached server daemon (process_bin_sasl_auth) --> + <cve>CVE-2016-8704</cve> <!-- Integer overflow in memcached server daemon (process_bin_append_prepend) --> + <cve>CVE-2023-46852</cve> <!-- Buffer overflow in memcached server daemon proxy mode multiget --> + <cve>CVE-2018-1000127</cve> <!-- Integer overflow in memcached server daemon (items.c item_free) --> + <cve>CVE-2023-46853</cve> <!-- Off-by-one in memcached server daemon proxy mode request parsing --> + <cve>CVE-2017-9951</cve> <!-- Heap buffer over-read in memcached server daemon (try_read_command) --> + </suppress> + + <suppress> + <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the optional buf + argument is provided. Druid's web console uses only uuidv4() with no buf argument + (web-console/src/druid-models/workbench-query/workbench-query.ts), so the + vulnerable code path is never exercised. --> + <notes><![CDATA[ + file name: package-lock.json (pkg:npm/[email protected]) + ]]></notes> + <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl> Review Comment: Rather than suppress in master, can we update `uuid`? ########## owasp-dependency-check-suppressions.xml: ########## @@ -768,4 +869,156 @@ <packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl> <cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go (google.golang.org/grpc < 1.79.3), not gRPC Java - https://nvd.nist.gov/vuln/detail/CVE-2026-33186 --> </suppress> + + <suppress> + <!-- False positive: the scanner matches the Java client version 1.2.4 against + cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon). + com.amazonaws:elasticache-java-cluster-client is a Java Memcached client + library; all CVEs below are vulnerabilities in the Memcached server C code. + Druid acts as a Memcached client and is not affected by server-side CVEs. --> + <notes><![CDATA[ + file name: elasticache-java-cluster-client-1.2.4.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/com\.amazonaws/elasticache-java-cluster-client@.*$</packageUrl> + <cve>CVE-2019-11596</cve> <!-- NULL ptr deref in memcached server daemon (memcached.c lru mode command) --> + <cve>CVE-2026-47784</cve> <!-- SASL password timing side-channel in memcached server daemon --> + <cve>CVE-2026-47783</cve> <!-- SASL username timing side-channel in memcached server daemon --> + <cve>CVE-2016-8705</cve> <!-- Integer overflow in memcached server daemon (process_bin_update) --> + <cve>CVE-2016-8706</cve> <!-- Integer overflow in memcached server daemon (process_bin_sasl_auth) --> + <cve>CVE-2016-8704</cve> <!-- Integer overflow in memcached server daemon (process_bin_append_prepend) --> + <cve>CVE-2023-46852</cve> <!-- Buffer overflow in memcached server daemon proxy mode multiget --> + <cve>CVE-2018-1000127</cve> <!-- Integer overflow in memcached server daemon (items.c item_free) --> + <cve>CVE-2023-46853</cve> <!-- Off-by-one in memcached server daemon proxy mode request parsing --> + <cve>CVE-2017-9951</cve> <!-- Heap buffer over-read in memcached server daemon (try_read_command) --> + </suppress> + + <suppress> + <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the optional buf + argument is provided. Druid's web console uses only uuidv4() with no buf argument + (web-console/src/druid-models/workbench-query/workbench-query.ts), so the + vulnerable code path is never exercised. --> + <notes><![CDATA[ + file name: package-lock.json (pkg:npm/[email protected]) + ]]></notes> + <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl> + <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName> + </suppress> + + <suppress> + <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache metadata (Kotlin compiler/Gradle plugin). + This is a build-toolchain vulnerability, not a runtime stdlib issue. Druid has no Kotlin source files; + kotlin-stdlib is a transitive runtime dependency (via Iceberg) and Druid never invokes Kotlin's build cache. --> + <notes><![CDATA[ + file name: kotlin-stdlib-2.4.10.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl> + <cve>CVE-2026-53914</cve> + </suppress> + + <suppress> + <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys local cryptographic verification path. + Druid's azure-extensions use azure-core/azure-identity for blob storage auth only; Druid does not use + azure-keyvault-keys or the local cryptography client path that contains the vulnerability. --> + <notes><![CDATA[ + file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar azure-identity-1.18.4.jar azure-json-1.5.1.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/com\.azure/azure-.*@.*$</packageUrl> + <cve>CVE-2026-33117</cve> + </suppress> + + <suppress> + <!-- CVE-2026-49845: SQL injection in Hive Metastore partition-name resolution. + CVE-2026-53561: SAML bearer-token authentication bypass in HiveServer2. + CVE-2026-55976: SSRF via avro.schema.url in Avro SerDe schema resolution. + All three affect Apache Hive server components (Metastore, HiveServer2). + Druid uses hive-storage-api only for the Murmur3 hash utility + (BloomKFilter.java) and ORC/Parquet column type definitions — it does not + run or connect to a Hive Metastore or HiveServer2. --> + <notes><![CDATA[ + file name: hive-storage-api-4.2.0.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@.*$</packageUrl> + <cve>CVE-2026-49845</cve> + <cve>CVE-2026-53561</cve> + <cve>CVE-2026-55976</cve> + </suppress> + + <suppress> + <!-- CVE-2026-54512, CVE-2026-54513: PolymorphicTypeValidator bypass in jackson-databind when + polymorphic typing is enabled with generic type parameters or array subtypes. + These CVEs affect jackson-databind shaded inside hadoop-client-runtime-3.5.0.jar and + parquet-jackson-1.18.0.jar — not Druid's own jackson-databind (2.22.x). Druid cannot + upgrade the jackson version inside these third-party shaded jars. Druid's own usage of + @JsonTypeInfo uses a custom StrictTypeIdResolver that is not affected by these bypass paths. + CVE-2026-68497: Not yet published in NVD; suppressed as appearing only inside shaded + hadoop/parquet jars that Druid cannot control. --> + <notes><![CDATA[ + file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind 2.18.6) + parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1) + ]]></notes> + <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson-databind@(2\.18\.|2\.22\.).*$</packageUrl> + <cve>CVE-2026-54512</cve> + <cve>CVE-2026-54513</cve> + <cve>CVE-2026-68497</cve> + </suppress> + + <suppress> + <!-- CVE-2026-2332: Jetty HTTP/1.1 request smuggling via chunk extension quoted strings. + CVE-2026-10050: Jetty Digest auth password encoding using ISO-8859-1. + Both affect Jetty shaded inside hadoop-client-runtime-3.5.0.jar. Druid cannot upgrade + the Jetty version inside this shaded jar. The shaded Jetty is used only for Hadoop's + internal HTTP server (WebHDFS, etc.), not for Druid's own HTTP server (Jetty 12.x). + Druid does not use Hadoop's embedded Jetty server or Digest auth. --> + <notes><![CDATA[ + file name: hadoop-client-runtime-3.5.0.jar (shaded org.eclipse.jetty* 9.4.58.v20250814) + ]]></notes> + <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty(\.[^/]+)?/.*@9\.4\.58.*$</packageUrl> Review Comment: Should be updated to only apply to the shaded jar. ########## owasp-dependency-check-suppressions.xml: ########## @@ -768,4 +869,156 @@ <packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl> <cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go (google.golang.org/grpc < 1.79.3), not gRPC Java - https://nvd.nist.gov/vuln/detail/CVE-2026-33186 --> </suppress> + + <suppress> + <!-- False positive: the scanner matches the Java client version 1.2.4 against + cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon). + com.amazonaws:elasticache-java-cluster-client is a Java Memcached client + library; all CVEs below are vulnerabilities in the Memcached server C code. + Druid acts as a Memcached client and is not affected by server-side CVEs. --> + <notes><![CDATA[ + file name: elasticache-java-cluster-client-1.2.4.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/com\.amazonaws/elasticache-java-cluster-client@.*$</packageUrl> + <cve>CVE-2019-11596</cve> <!-- NULL ptr deref in memcached server daemon (memcached.c lru mode command) --> + <cve>CVE-2026-47784</cve> <!-- SASL password timing side-channel in memcached server daemon --> + <cve>CVE-2026-47783</cve> <!-- SASL username timing side-channel in memcached server daemon --> + <cve>CVE-2016-8705</cve> <!-- Integer overflow in memcached server daemon (process_bin_update) --> + <cve>CVE-2016-8706</cve> <!-- Integer overflow in memcached server daemon (process_bin_sasl_auth) --> + <cve>CVE-2016-8704</cve> <!-- Integer overflow in memcached server daemon (process_bin_append_prepend) --> + <cve>CVE-2023-46852</cve> <!-- Buffer overflow in memcached server daemon proxy mode multiget --> + <cve>CVE-2018-1000127</cve> <!-- Integer overflow in memcached server daemon (items.c item_free) --> + <cve>CVE-2023-46853</cve> <!-- Off-by-one in memcached server daemon proxy mode request parsing --> + <cve>CVE-2017-9951</cve> <!-- Heap buffer over-read in memcached server daemon (try_read_command) --> + </suppress> + + <suppress> + <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the optional buf + argument is provided. Druid's web console uses only uuidv4() with no buf argument + (web-console/src/druid-models/workbench-query/workbench-query.ts), so the + vulnerable code path is never exercised. --> + <notes><![CDATA[ + file name: package-lock.json (pkg:npm/[email protected]) + ]]></notes> + <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl> + <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName> + </suppress> + + <suppress> + <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache metadata (Kotlin compiler/Gradle plugin). + This is a build-toolchain vulnerability, not a runtime stdlib issue. Druid has no Kotlin source files; + kotlin-stdlib is a transitive runtime dependency (via Iceberg) and Druid never invokes Kotlin's build cache. --> + <notes><![CDATA[ + file name: kotlin-stdlib-2.4.10.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl> + <cve>CVE-2026-53914</cve> + </suppress> + + <suppress> + <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys local cryptographic verification path. + Druid's azure-extensions use azure-core/azure-identity for blob storage auth only; Druid does not use + azure-keyvault-keys or the local cryptography client path that contains the vulnerability. --> Review Comment: If we don't use `azure-keyvault-keys` at all, it's better to exclude the dependency rather than suppress the CVE. ########## owasp-dependency-check-suppressions.xml: ########## @@ -274,6 +320,61 @@ <cve>CVE-2025-58057</cve> <!-- Netty 3.x not affected; compression issue only in 4.x --> <cve>CVE-2026-33870</cve> <!-- We don't use HttpPostRequestDecoder --> <cve>CVE-2026-33871</cve> <!-- Netty 3.x not affected; HTTP/2 issues only in 4.x --> + <cve>CVE-2026-44893</cve> <!-- We don't use the HAProxy codec --> + <cve>CVE-2026-44250</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-48059</cve> <!-- We don't use the HAProxy codec --> + <cve>CVE-2026-44890</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-44891</cve> <!-- We don't use the STOMP codec --> + <cve>CVE-2026-50011</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-59901</cve> <!-- We don't use Netty's Bzip2Decoder; Druid uses Apache Commons Compress for bzip2 --> + <cve>CVE-2026-62380</cve> <!-- We don't use the SOCKS codec; Druid uses HTTP CONNECT proxy tunneling --> + <cve>CVE-2026-59898</cve> <!-- Server-side WebSocket vulnerability; Druid's HTTP server is Jetty, not Netty --> + <cve>CVE-2026-59899</cve> <!-- Server-side HttpContentEncoder vulnerability; Druid uses Netty 3.x as HTTP client only --> + <cve>CVE-2026-42587</cve> <!-- Affects brotli/zstd/snappy decompression added in Netty 4.x; Netty 3.x only supports gzip/deflate --> + <cve>CVE-2026-42586</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-44248</cve> <!-- We don't use the MQTT codec --> + <cve>CVE-2026-44249</cve> <!-- We don't use Netty's IpSubnetFilterRule; Druid uses Jetty for HTTP access control --> + <cve>CVE-2026-45416</cve> <!-- Server-side TLS SNI vulnerability; Druid uses Netty 3.x as TLS client only, never as a server --> + <cve>CVE-2026-42581</cve> <!-- Server-side HTTP request smuggling; Druid's HTTP server is Jetty, not Netty --> + <cve>CVE-2026-45674</cve> <!-- Affects netty-resolver-dns which Druid doesn't use; Druid uses JDK DNS resolution --> + <cve>CVE-2026-48006</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-42585</cve> <!-- Server-side HTTP request smuggling; Druid's HTTP server is Jetty, not Netty --> + <cve>CVE-2026-42584</cve> <!-- HttpClientCodec response desynchronization in Netty 4.x codec; Druid uses Netty 3.x's HttpClientCodec which has a different implementation --> + <cve>CVE-2026-46340</cve> <!-- We don't use SCTP transport; Druid uses TCP/NIO --> + <cve>CVE-2026-42583</cve> <!-- We don't use Netty's Lz4FrameDecoder; Druid uses lz4-java directly --> + <cve>CVE-2026-48043</cve> <!-- We don't use netty-codec-http2 directly; Druid's HTTP/2 is served by Jetty --> + <cve>CVE-2026-56822</cve> <!-- We don't use netty-handler-ssl-ocsp --> + <cve>CVE-2026-56821</cve> <!-- We don't use netty-handler-ssl-ocsp --> + <cve>CVE-2026-47691</cve> <!-- Affects netty-resolver-dns which Druid doesn't use; Druid uses JDK DNS resolution --> + <cve>CVE-2026-56820</cve> <!-- We don't use netty-handler-ssl-ocsp --> + <cve>CVE-2026-50010</cve> <!-- Druid's Netty 3.x HTTP client does not use SslContextBuilder; gRPC/AWS SDK paths use managed SSL contexts --> + <cve>CVE-2026-42578</cve> <!-- We don't use HttpProxyHandler; Druid uses a custom HTTP CONNECT tunnel via HttpClientCodec --> + <cve>CVE-2026-42579</cve> <!-- We don't use netty-codec-dns; Druid uses JDK DNS resolution --> + </suppress> + + <suppress> + <!-- Netty 4.x CVEs for codecs/features that Druid never activates. Review Comment: We shouldn't need any Netty 4 suppressions in the PR to `master`, since we should be using an up-to-date Netty 4. Please remove the Netty 4 suppressions and validate that things still pass. ########## owasp-dependency-check-suppressions.xml: ########## @@ -768,4 +869,156 @@ <packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl> <cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go (google.golang.org/grpc < 1.79.3), not gRPC Java - https://nvd.nist.gov/vuln/detail/CVE-2026-33186 --> </suppress> + + <suppress> + <!-- False positive: the scanner matches the Java client version 1.2.4 against + cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon). + com.amazonaws:elasticache-java-cluster-client is a Java Memcached client + library; all CVEs below are vulnerabilities in the Memcached server C code. + Druid acts as a Memcached client and is not affected by server-side CVEs. --> + <notes><![CDATA[ + file name: elasticache-java-cluster-client-1.2.4.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/com\.amazonaws/elasticache-java-cluster-client@.*$</packageUrl> + <cve>CVE-2019-11596</cve> <!-- NULL ptr deref in memcached server daemon (memcached.c lru mode command) --> + <cve>CVE-2026-47784</cve> <!-- SASL password timing side-channel in memcached server daemon --> + <cve>CVE-2026-47783</cve> <!-- SASL username timing side-channel in memcached server daemon --> + <cve>CVE-2016-8705</cve> <!-- Integer overflow in memcached server daemon (process_bin_update) --> + <cve>CVE-2016-8706</cve> <!-- Integer overflow in memcached server daemon (process_bin_sasl_auth) --> + <cve>CVE-2016-8704</cve> <!-- Integer overflow in memcached server daemon (process_bin_append_prepend) --> + <cve>CVE-2023-46852</cve> <!-- Buffer overflow in memcached server daemon proxy mode multiget --> + <cve>CVE-2018-1000127</cve> <!-- Integer overflow in memcached server daemon (items.c item_free) --> + <cve>CVE-2023-46853</cve> <!-- Off-by-one in memcached server daemon proxy mode request parsing --> + <cve>CVE-2017-9951</cve> <!-- Heap buffer over-read in memcached server daemon (try_read_command) --> + </suppress> + + <suppress> + <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the optional buf + argument is provided. Druid's web console uses only uuidv4() with no buf argument + (web-console/src/druid-models/workbench-query/workbench-query.ts), so the + vulnerable code path is never exercised. --> + <notes><![CDATA[ + file name: package-lock.json (pkg:npm/[email protected]) + ]]></notes> + <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl> + <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName> + </suppress> + + <suppress> + <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache metadata (Kotlin compiler/Gradle plugin). + This is a build-toolchain vulnerability, not a runtime stdlib issue. Druid has no Kotlin source files; + kotlin-stdlib is a transitive runtime dependency (via Iceberg) and Druid never invokes Kotlin's build cache. --> + <notes><![CDATA[ + file name: kotlin-stdlib-2.4.10.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl> + <cve>CVE-2026-53914</cve> + </suppress> + + <suppress> + <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys local cryptographic verification path. + Druid's azure-extensions use azure-core/azure-identity for blob storage auth only; Druid does not use + azure-keyvault-keys or the local cryptography client path that contains the vulnerability. --> + <notes><![CDATA[ + file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar azure-identity-1.18.4.jar azure-json-1.5.1.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/com\.azure/azure-.*@.*$</packageUrl> + <cve>CVE-2026-33117</cve> + </suppress> + + <suppress> + <!-- CVE-2026-49845: SQL injection in Hive Metastore partition-name resolution. + CVE-2026-53561: SAML bearer-token authentication bypass in HiveServer2. + CVE-2026-55976: SSRF via avro.schema.url in Avro SerDe schema resolution. + All three affect Apache Hive server components (Metastore, HiveServer2). + Druid uses hive-storage-api only for the Murmur3 hash utility + (BloomKFilter.java) and ORC/Parquet column type definitions — it does not + run or connect to a Hive Metastore or HiveServer2. --> + <notes><![CDATA[ + file name: hive-storage-api-4.2.0.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@.*$</packageUrl> + <cve>CVE-2026-49845</cve> + <cve>CVE-2026-53561</cve> + <cve>CVE-2026-55976</cve> + </suppress> + + <suppress> + <!-- CVE-2026-54512, CVE-2026-54513: PolymorphicTypeValidator bypass in jackson-databind when + polymorphic typing is enabled with generic type parameters or array subtypes. + These CVEs affect jackson-databind shaded inside hadoop-client-runtime-3.5.0.jar and + parquet-jackson-1.18.0.jar — not Druid's own jackson-databind (2.22.x). Druid cannot + upgrade the jackson version inside these third-party shaded jars. Druid's own usage of + @JsonTypeInfo uses a custom StrictTypeIdResolver that is not affected by these bypass paths. + CVE-2026-68497: Not yet published in NVD; suppressed as appearing only inside shaded + hadoop/parquet jars that Druid cannot control. --> + <notes><![CDATA[ + file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind 2.18.6) + parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1) + ]]></notes> + <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson-databind@(2\.18\.|2\.22\.).*$</packageUrl> + <cve>CVE-2026-54512</cve> + <cve>CVE-2026-54513</cve> + <cve>CVE-2026-68497</cve> + </suppress> + + <suppress> + <!-- CVE-2026-2332: Jetty HTTP/1.1 request smuggling via chunk extension quoted strings. + CVE-2026-10050: Jetty Digest auth password encoding using ISO-8859-1. + Both affect Jetty shaded inside hadoop-client-runtime-3.5.0.jar. Druid cannot upgrade + the Jetty version inside this shaded jar. The shaded Jetty is used only for Hadoop's + internal HTTP server (WebHDFS, etc.), not for Druid's own HTTP server (Jetty 12.x). + Druid does not use Hadoop's embedded Jetty server or Digest auth. --> + <notes><![CDATA[ + file name: hadoop-client-runtime-3.5.0.jar (shaded org.eclipse.jetty* 9.4.58.v20250814) + ]]></notes> + <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty(\.[^/]+)?/.*@9\.4\.58.*$</packageUrl> + <cve>CVE-2026-2332</cve> + <cve>CVE-2026-10050</cve> + </suppress> + + <suppress> + <!-- CVE-2026-56741, CVE-2026-56740: DoS via JLine Telnet server (NAWS terminal dimensions and + NEW-ENVIRON flooding). JLine is shaded inside hadoop-client-runtime-3.5.0.jar and is used + only for Hadoop's interactive CLI shell. Druid does not expose a JLine Telnet server endpoint. --> + <notes><![CDATA[ + file name: hadoop-client-runtime-3.5.0.jar (shaded jline 3.9.0) + ]]></notes> + <packageUrl regex="true">^pkg:maven/org\.jline/jline.*@.*$</packageUrl> Review Comment: Should be updated to only apply to the shaded jar. ########## owasp-dependency-check-suppressions.xml: ########## @@ -274,6 +320,69 @@ <cve>CVE-2025-58057</cve> <!-- Netty 3.x not affected; compression issue only in 4.x --> <cve>CVE-2026-33870</cve> <!-- We don't use HttpPostRequestDecoder --> <cve>CVE-2026-33871</cve> <!-- Netty 3.x not affected; HTTP/2 issues only in 4.x --> + <cve>CVE-2026-44893</cve> <!-- We don't use the HAProxy codec --> + <cve>CVE-2026-44250</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-48059</cve> <!-- We don't use the HAProxy codec --> + <cve>CVE-2026-44890</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-44891</cve> <!-- We don't use the STOMP codec --> + <cve>CVE-2026-50011</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-59901</cve> <!-- We don't use Netty's Bzip2Decoder; Druid uses Apache Commons Compress for bzip2 --> + <cve>CVE-2026-62380</cve> <!-- We don't use the SOCKS codec; Druid uses HTTP CONNECT proxy tunneling --> + <cve>CVE-2026-59898</cve> <!-- Server-side WebSocket vulnerability; Druid's HTTP server is Jetty, not Netty --> + <cve>CVE-2026-59899</cve> <!-- Server-side HttpContentEncoder vulnerability; Druid uses Netty 3.x as HTTP client only --> + <cve>CVE-2026-42587</cve> <!-- Affects brotli/zstd/snappy decompression added in Netty 4.x; Netty 3.x only supports gzip/deflate --> + <cve>CVE-2026-42586</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-44248</cve> <!-- We don't use the MQTT codec --> + <cve>CVE-2026-44249</cve> <!-- We don't use Netty's IpSubnetFilterRule; Druid uses Jetty for HTTP access control --> + <cve>CVE-2026-45416</cve> <!-- Server-side TLS SNI vulnerability; Druid uses Netty 3.x as TLS client only, never as a server --> + <cve>CVE-2026-42581</cve> <!-- Server-side HTTP request smuggling; Druid's HTTP server is Jetty, not Netty --> + <cve>CVE-2026-45674</cve> <!-- Affects netty-resolver-dns which Druid doesn't use; Druid uses JDK DNS resolution --> + <cve>CVE-2026-48006</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-42585</cve> <!-- Server-side HTTP request smuggling; Druid's HTTP server is Jetty, not Netty --> + <cve>CVE-2026-42584</cve> <!-- HttpClientCodec response desynchronization in Netty 4.x codec; Druid uses Netty 3.x's HttpClientCodec which has a different implementation --> Review Comment: I believe this suppression is defensible but for a different reason. We use Netty 3 only for `NettyHttpClient`, which is only used for Druid-to-Druid server communication, and Druid servers don't pipeline requests (we wait for the response first), don't send HEAD to each other, and shouldn't be replying to each other with 1xx's. The advisory says all three are required. Anyway, WTB https://github.com/apache/druid/pull/19567. ########## owasp-dependency-check-suppressions.xml: ########## @@ -274,6 +320,61 @@ <cve>CVE-2025-58057</cve> <!-- Netty 3.x not affected; compression issue only in 4.x --> <cve>CVE-2026-33870</cve> <!-- We don't use HttpPostRequestDecoder --> <cve>CVE-2026-33871</cve> <!-- Netty 3.x not affected; HTTP/2 issues only in 4.x --> + <cve>CVE-2026-44893</cve> <!-- We don't use the HAProxy codec --> + <cve>CVE-2026-44250</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-48059</cve> <!-- We don't use the HAProxy codec --> + <cve>CVE-2026-44890</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-44891</cve> <!-- We don't use the STOMP codec --> + <cve>CVE-2026-50011</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-59901</cve> <!-- We don't use Netty's Bzip2Decoder; Druid uses Apache Commons Compress for bzip2 --> + <cve>CVE-2026-62380</cve> <!-- We don't use the SOCKS codec; Druid uses HTTP CONNECT proxy tunneling --> + <cve>CVE-2026-59898</cve> <!-- Server-side WebSocket vulnerability; Druid's HTTP server is Jetty, not Netty --> + <cve>CVE-2026-59899</cve> <!-- Server-side HttpContentEncoder vulnerability; Druid uses Netty 3.x as HTTP client only --> + <cve>CVE-2026-42587</cve> <!-- Affects brotli/zstd/snappy decompression added in Netty 4.x; Netty 3.x only supports gzip/deflate --> + <cve>CVE-2026-42586</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-44248</cve> <!-- We don't use the MQTT codec --> + <cve>CVE-2026-44249</cve> <!-- We don't use Netty's IpSubnetFilterRule; Druid uses Jetty for HTTP access control --> + <cve>CVE-2026-45416</cve> <!-- Server-side TLS SNI vulnerability; Druid uses Netty 3.x as TLS client only, never as a server --> + <cve>CVE-2026-42581</cve> <!-- Server-side HTTP request smuggling; Druid's HTTP server is Jetty, not Netty --> + <cve>CVE-2026-45674</cve> <!-- Affects netty-resolver-dns which Druid doesn't use; Druid uses JDK DNS resolution --> + <cve>CVE-2026-48006</cve> <!-- We don't use the Redis codec --> + <cve>CVE-2026-42585</cve> <!-- Server-side HTTP request smuggling; Druid's HTTP server is Jetty, not Netty --> + <cve>CVE-2026-42584</cve> <!-- HttpClientCodec response desynchronization in Netty 4.x codec; Druid uses Netty 3.x's HttpClientCodec which has a different implementation --> + <cve>CVE-2026-46340</cve> <!-- We don't use SCTP transport; Druid uses TCP/NIO --> + <cve>CVE-2026-42583</cve> <!-- We don't use Netty's Lz4FrameDecoder; Druid uses lz4-java directly --> + <cve>CVE-2026-48043</cve> <!-- We don't use netty-codec-http2 directly; Druid's HTTP/2 is served by Jetty --> + <cve>CVE-2026-56822</cve> <!-- We don't use netty-handler-ssl-ocsp --> + <cve>CVE-2026-56821</cve> <!-- We don't use netty-handler-ssl-ocsp --> + <cve>CVE-2026-47691</cve> <!-- Affects netty-resolver-dns which Druid doesn't use; Druid uses JDK DNS resolution --> + <cve>CVE-2026-56820</cve> <!-- We don't use netty-handler-ssl-ocsp --> + <cve>CVE-2026-50010</cve> <!-- Druid's Netty 3.x HTTP client does not use SslContextBuilder; gRPC/AWS SDK paths use managed SSL contexts --> + <cve>CVE-2026-42578</cve> <!-- We don't use HttpProxyHandler; Druid uses a custom HTTP CONNECT tunnel via HttpClientCodec --> + <cve>CVE-2026-42579</cve> <!-- We don't use netty-codec-dns; Druid uses JDK DNS resolution --> + </suppress> + + <suppress> + <!-- Netty 4.x CVEs for codecs/features that Druid never activates. + Druid's HTTP server is Jetty; Netty 4.x is present as a transitive dependency + (gRPC, AWS SDK) for buffer management and internal comms only. --> + <notes><![CDATA[ + file name: netty-codec-protobuf-4.2.15.Final.jar netty-transport-4.2.15.Final.jar (and other netty-*.jar at 4.2.x) + ]]></notes> + <packageUrl regex="true">^pkg:maven/io\.netty/netty-.*@4\.2\..*$</packageUrl> + <cve>CVE-2026-56819</cve> <!-- HTTP/2 decompressor ByteBuf leak: Druid does not run a Netty 4.x HTTP/2 server --> Review Comment: We might do so in the gRPC extension. But I think it doesn't matter anyway, because none of these suppressions should need to be here, because we should be on the latest Netty 4. ########## owasp-dependency-check-suppressions.xml: ########## @@ -768,4 +869,156 @@ <packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl> <cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go (google.golang.org/grpc < 1.79.3), not gRPC Java - https://nvd.nist.gov/vuln/detail/CVE-2026-33186 --> </suppress> + + <suppress> + <!-- False positive: the scanner matches the Java client version 1.2.4 against + cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon). + com.amazonaws:elasticache-java-cluster-client is a Java Memcached client + library; all CVEs below are vulnerabilities in the Memcached server C code. + Druid acts as a Memcached client and is not affected by server-side CVEs. --> + <notes><![CDATA[ + file name: elasticache-java-cluster-client-1.2.4.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/com\.amazonaws/elasticache-java-cluster-client@.*$</packageUrl> + <cve>CVE-2019-11596</cve> <!-- NULL ptr deref in memcached server daemon (memcached.c lru mode command) --> + <cve>CVE-2026-47784</cve> <!-- SASL password timing side-channel in memcached server daemon --> + <cve>CVE-2026-47783</cve> <!-- SASL username timing side-channel in memcached server daemon --> + <cve>CVE-2016-8705</cve> <!-- Integer overflow in memcached server daemon (process_bin_update) --> + <cve>CVE-2016-8706</cve> <!-- Integer overflow in memcached server daemon (process_bin_sasl_auth) --> + <cve>CVE-2016-8704</cve> <!-- Integer overflow in memcached server daemon (process_bin_append_prepend) --> + <cve>CVE-2023-46852</cve> <!-- Buffer overflow in memcached server daemon proxy mode multiget --> + <cve>CVE-2018-1000127</cve> <!-- Integer overflow in memcached server daemon (items.c item_free) --> + <cve>CVE-2023-46853</cve> <!-- Off-by-one in memcached server daemon proxy mode request parsing --> + <cve>CVE-2017-9951</cve> <!-- Heap buffer over-read in memcached server daemon (try_read_command) --> + </suppress> + + <suppress> + <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the optional buf + argument is provided. Druid's web console uses only uuidv4() with no buf argument + (web-console/src/druid-models/workbench-query/workbench-query.ts), so the + vulnerable code path is never exercised. --> + <notes><![CDATA[ + file name: package-lock.json (pkg:npm/[email protected]) + ]]></notes> + <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl> + <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName> + </suppress> + + <suppress> + <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache metadata (Kotlin compiler/Gradle plugin). + This is a build-toolchain vulnerability, not a runtime stdlib issue. Druid has no Kotlin source files; + kotlin-stdlib is a transitive runtime dependency (via Iceberg) and Druid never invokes Kotlin's build cache. --> + <notes><![CDATA[ + file name: kotlin-stdlib-2.4.10.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl> + <cve>CVE-2026-53914</cve> + </suppress> + + <suppress> + <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys local cryptographic verification path. + Druid's azure-extensions use azure-core/azure-identity for blob storage auth only; Druid does not use + azure-keyvault-keys or the local cryptography client path that contains the vulnerability. --> + <notes><![CDATA[ + file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar azure-identity-1.18.4.jar azure-json-1.5.1.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/com\.azure/azure-.*@.*$</packageUrl> + <cve>CVE-2026-33117</cve> + </suppress> + + <suppress> + <!-- CVE-2026-49845: SQL injection in Hive Metastore partition-name resolution. + CVE-2026-53561: SAML bearer-token authentication bypass in HiveServer2. + CVE-2026-55976: SSRF via avro.schema.url in Avro SerDe schema resolution. + All three affect Apache Hive server components (Metastore, HiveServer2). + Druid uses hive-storage-api only for the Murmur3 hash utility + (BloomKFilter.java) and ORC/Parquet column type definitions — it does not + run or connect to a Hive Metastore or HiveServer2. --> + <notes><![CDATA[ + file name: hive-storage-api-4.2.0.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@.*$</packageUrl> + <cve>CVE-2026-49845</cve> + <cve>CVE-2026-53561</cve> + <cve>CVE-2026-55976</cve> + </suppress> + + <suppress> + <!-- CVE-2026-54512, CVE-2026-54513: PolymorphicTypeValidator bypass in jackson-databind when + polymorphic typing is enabled with generic type parameters or array subtypes. + These CVEs affect jackson-databind shaded inside hadoop-client-runtime-3.5.0.jar and + parquet-jackson-1.18.0.jar — not Druid's own jackson-databind (2.22.x). Druid cannot + upgrade the jackson version inside these third-party shaded jars. Druid's own usage of + @JsonTypeInfo uses a custom StrictTypeIdResolver that is not affected by these bypass paths. + CVE-2026-68497: Not yet published in NVD; suppressed as appearing only inside shaded + hadoop/parquet jars that Druid cannot control. --> + <notes><![CDATA[ + file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind 2.18.6) + parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1) + ]]></notes> + <packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson-databind@(2\.18\.|2\.22\.).*$</packageUrl> Review Comment: Agreed that this should be written to only match the shaded jars. ########## owasp-dependency-check-suppressions.xml: ########## @@ -768,4 +869,156 @@ <packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl> <cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go (google.golang.org/grpc < 1.79.3), not gRPC Java - https://nvd.nist.gov/vuln/detail/CVE-2026-33186 --> </suppress> + + <suppress> + <!-- False positive: the scanner matches the Java client version 1.2.4 against + cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon). + com.amazonaws:elasticache-java-cluster-client is a Java Memcached client + library; all CVEs below are vulnerabilities in the Memcached server C code. + Druid acts as a Memcached client and is not affected by server-side CVEs. --> + <notes><![CDATA[ + file name: elasticache-java-cluster-client-1.2.4.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/com\.amazonaws/elasticache-java-cluster-client@.*$</packageUrl> + <cve>CVE-2019-11596</cve> <!-- NULL ptr deref in memcached server daemon (memcached.c lru mode command) --> + <cve>CVE-2026-47784</cve> <!-- SASL password timing side-channel in memcached server daemon --> + <cve>CVE-2026-47783</cve> <!-- SASL username timing side-channel in memcached server daemon --> + <cve>CVE-2016-8705</cve> <!-- Integer overflow in memcached server daemon (process_bin_update) --> + <cve>CVE-2016-8706</cve> <!-- Integer overflow in memcached server daemon (process_bin_sasl_auth) --> + <cve>CVE-2016-8704</cve> <!-- Integer overflow in memcached server daemon (process_bin_append_prepend) --> + <cve>CVE-2023-46852</cve> <!-- Buffer overflow in memcached server daemon proxy mode multiget --> + <cve>CVE-2018-1000127</cve> <!-- Integer overflow in memcached server daemon (items.c item_free) --> + <cve>CVE-2023-46853</cve> <!-- Off-by-one in memcached server daemon proxy mode request parsing --> + <cve>CVE-2017-9951</cve> <!-- Heap buffer over-read in memcached server daemon (try_read_command) --> + </suppress> + + <suppress> + <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the optional buf + argument is provided. Druid's web console uses only uuidv4() with no buf argument + (web-console/src/druid-models/workbench-query/workbench-query.ts), so the + vulnerable code path is never exercised. --> + <notes><![CDATA[ + file name: package-lock.json (pkg:npm/[email protected]) + ]]></notes> + <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl> + <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName> + </suppress> + + <suppress> + <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache metadata (Kotlin compiler/Gradle plugin). + This is a build-toolchain vulnerability, not a runtime stdlib issue. Druid has no Kotlin source files; + kotlin-stdlib is a transitive runtime dependency (via Iceberg) and Druid never invokes Kotlin's build cache. --> + <notes><![CDATA[ + file name: kotlin-stdlib-2.4.10.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl> + <cve>CVE-2026-53914</cve> + </suppress> + + <suppress> + <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys local cryptographic verification path. + Druid's azure-extensions use azure-core/azure-identity for blob storage auth only; Druid does not use + azure-keyvault-keys or the local cryptography client path that contains the vulnerability. --> + <notes><![CDATA[ + file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar azure-identity-1.18.4.jar azure-json-1.5.1.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/com\.azure/azure-.*@.*$</packageUrl> + <cve>CVE-2026-33117</cve> + </suppress> + + <suppress> + <!-- CVE-2026-49845: SQL injection in Hive Metastore partition-name resolution. + CVE-2026-53561: SAML bearer-token authentication bypass in HiveServer2. + CVE-2026-55976: SSRF via avro.schema.url in Avro SerDe schema resolution. + All three affect Apache Hive server components (Metastore, HiveServer2). + Druid uses hive-storage-api only for the Murmur3 hash utility + (BloomKFilter.java) and ORC/Parquet column type definitions — it does not + run or connect to a Hive Metastore or HiveServer2. --> + <notes><![CDATA[ + file name: hive-storage-api-4.2.0.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@.*$</packageUrl> + <cve>CVE-2026-49845</cve> + <cve>CVE-2026-53561</cve> + <cve>CVE-2026-55976</cve> + </suppress> + + <suppress> + <!-- CVE-2026-54512, CVE-2026-54513: PolymorphicTypeValidator bypass in jackson-databind when + polymorphic typing is enabled with generic type parameters or array subtypes. + These CVEs affect jackson-databind shaded inside hadoop-client-runtime-3.5.0.jar and + parquet-jackson-1.18.0.jar — not Druid's own jackson-databind (2.22.x). Druid cannot + upgrade the jackson version inside these third-party shaded jars. Druid's own usage of + @JsonTypeInfo uses a custom StrictTypeIdResolver that is not affected by these bypass paths. Review Comment: Is this comment entirely true? I don't think we typically use a custom `StrictTypeIdResolver`. We do typically use `Id.NAME` for type info though, which isn't vulnerable to this class of problems. Anyway, I also think this is over-arguing the point. It can't be relevant *both* that these Jacksons are only used by shaded Hadoop jars, and that Druid uses `@JsonTypeInfo` in a safe way. If the former is true then the latter is irrelevant. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
