kfaraz commented on code in PR #20236:
URL: https://github.com/apache/druid/pull/20236#discussion_r3992111069
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -768,4 +869,156 @@
<packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl>
<cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go
(google.golang.org/grpc < 1.79.3), not gRPC Java -
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 -->
</suppress>
+
+ <suppress>
+ <!-- False positive: the scanner matches the Java client version 1.2.4
against
+ cpe:2.3:a:memcached:memcached:1.2.4 (the C memcached server daemon).
+ com.amazonaws:elasticache-java-cluster-client is a Java Memcached
client
+ library; all CVEs below are vulnerabilities in the Memcached server C
code.
+ Druid acts as a Memcached client and is not affected by server-side
CVEs. -->
+ <notes><![CDATA[
+ file name: elasticache-java-cluster-client-1.2.4.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/com\.amazonaws/elasticache-java-cluster-client@.*$</packageUrl>
+ <cve>CVE-2019-11596</cve> <!-- NULL ptr deref in memcached server daemon
(memcached.c lru mode command) -->
+ <cve>CVE-2026-47784</cve> <!-- SASL password timing side-channel in
memcached server daemon -->
+ <cve>CVE-2026-47783</cve> <!-- SASL username timing side-channel in
memcached server daemon -->
+ <cve>CVE-2016-8705</cve> <!-- Integer overflow in memcached server daemon
(process_bin_update) -->
+ <cve>CVE-2016-8706</cve> <!-- Integer overflow in memcached server daemon
(process_bin_sasl_auth) -->
+ <cve>CVE-2016-8704</cve> <!-- Integer overflow in memcached server daemon
(process_bin_append_prepend) -->
+ <cve>CVE-2023-46852</cve> <!-- Buffer overflow in memcached server daemon
proxy mode multiget -->
+ <cve>CVE-2018-1000127</cve> <!-- Integer overflow in memcached server
daemon (items.c item_free) -->
+ <cve>CVE-2023-46853</cve> <!-- Off-by-one in memcached server daemon proxy
mode request parsing -->
+ <cve>CVE-2017-9951</cve> <!-- Heap buffer over-read in memcached server
daemon (try_read_command) -->
+ </suppress>
+
+ <suppress>
+ <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the
optional buf
+ argument is provided. Druid's web console uses only uuidv4() with no
buf argument
+ (web-console/src/druid-models/workbench-query/workbench-query.ts), so
the
+ vulnerable code path is never exercised. -->
+ <notes><![CDATA[
+ file name: package-lock.json (pkg:npm/[email protected])
+ ]]></notes>
+ <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl>
+ <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache
metadata (Kotlin compiler/Gradle plugin).
+ This is a build-toolchain vulnerability, not a runtime stdlib issue.
Druid has no Kotlin source files;
+ kotlin-stdlib is a transitive runtime dependency (via Iceberg) and
Druid never invokes Kotlin's build cache. -->
+ <notes><![CDATA[
+ file name: kotlin-stdlib-2.4.10.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl>
+ <cve>CVE-2026-53914</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys
local cryptographic verification path.
+ Druid's azure-extensions use azure-core/azure-identity for blob
storage auth only; Druid does not use
+ azure-keyvault-keys or the local cryptography client path that
contains the vulnerability. -->
Review Comment:
We are not pulling in the dependency `azure-keyvault-keys` anywhere but
apparently, the CVE gets flagged for other azure artifacts too (like
azure-core, azure-identity, etc).
I have updated the comment to avoid confusion.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
