This is an automated email from the ASF dual-hosted git repository. Fly-Style pushed a commit to branch 39.0.0-fix-zk-snappy-cves in repository https://gitbox.apache.org/repos/asf/druid.git
commit 824dcf3fb34f60f97a0c95b289b01f1fcd9f669f Author: Sasha Syrotenko <[email protected]> AuthorDate: Fri Nov 6 12:16:09 2026 +0200 fix: address various CVEs before the rc cooking --- licenses.yaml | 12 +++---- owasp-dependency-check-suppressions.xml | 59 +++++++++++++++++++++++---------- pom.xml | 10 +++--- 3 files changed, 52 insertions(+), 29 deletions(-) diff --git a/licenses.yaml b/licenses.yaml index e7dc6de1e76..9fa7ad597de 100644 --- a/licenses.yaml +++ b/licenses.yaml @@ -1852,7 +1852,7 @@ name: JSON Small and Fast Parser license_category: binary module: java-core license_name: Apache License version 2.0 -version: 2.6.0 +version: 2.6.1 libraries: - net.minidev: json-smart @@ -2281,7 +2281,7 @@ name: Apache Zookeeper license_category: binary module: java-core license_name: Apache License version 2.0 -version: 3.8.7 +version: 3.8.8 libraries: - org.apache.zookeeper: zookeeper - org.apache.zookeeper: zookeeper-jute @@ -2654,7 +2654,7 @@ name: JSON Small and Fast Parser license_category: binary module: extensions/druid-pac4j license_name: Apache License version 2.0 -version: 2.6.0 +version: 2.6.1 libraries: - net.minidev: json-smart --- @@ -2663,7 +2663,7 @@ name: JSON Small and Fast Parser license_category: binary module: extensions/druid-pac4j license_name: Apache License version 2.0 -version: 2.6.0 +version: 2.6.1 libraries: - net.minidev: accessors-smart --- @@ -3524,7 +3524,7 @@ name: ASM license_category: binary module: java-core license_name: BSD-3-Clause License -version: 9.10.1 +version: 9.11.1 copyright: INRIA, France Telecom license_file_path: licenses/bin/asm.BSD3 libraries: @@ -5133,7 +5133,7 @@ libraries: name: snappy-java license_category: binary -version: 1.1.10.8 +version: 1.1.10.12 module: java-core license_name: Apache License version 2.0 libraries: diff --git a/owasp-dependency-check-suppressions.xml b/owasp-dependency-check-suppressions.xml index ab63353772c..2acf463bc32 100644 --- a/owasp-dependency-check-suppressions.xml +++ b/owasp-dependency-check-suppressions.xml @@ -396,12 +396,15 @@ <!-- CVE-2022-3171: False positive. This CVE affects Google's protobuf-java (com.google.protobuf), but the scanner matches it against dev.cel:protobuf via the broad protobuf CPE. dev.cel:protobuf is part of the Common Expression Language library and is unrelated - to Google's protobuf-java parsing code that contains the vulnerability. --> + to Google's protobuf-java parsing code that contains the vulnerability. + CVE-2021-22569: False positive for the same reason. This CVE affects the parser of + com.google.protobuf:protobuf-java before 3.16.1, not dev.cel:protobuf. --> <notes><![CDATA[ file name: protobuf-0.13.0.jar ]]></notes> <packageUrl regex="true">^pkg:maven/dev\.cel/protobuf@.*$</packageUrl> <cve>CVE-2022-3171</cve> + <cve>CVE-2021-22569</cve> </suppress> <suppress> @@ -790,11 +793,13 @@ <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys local cryptographic verification path. The CVE fires against azure-core, azure-core-http-netty, azure-identity, and azure-json due to broad CPE matching, but none of these jars contain the vulnerable Key Vault code path. Druid uses these artifacts - for blob storage auth only and does not use the Key Vault cryptography client. --> + for blob storage auth only and does not use the Key Vault cryptography client. + NVD matches all azure_sdk_for_java versions before 4.10.6, so this entry matches all versions + of these four artifacts. Druid does not depend on azure-security-keyvault-keys. --> <notes><![CDATA[ - file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar azure-identity-1.18.4.jar azure-json-1.5.1.jar + file name: azure-core, azure-core-http-netty, azure-identity, azure-json ]]></notes> - <packageUrl regex="true">^pkg:maven/com\.azure/azure-(core@1\.58\.1|core-http-netty@1\.16\.5|identity@1\.18\.4|json@1\.5\.1)$</packageUrl> + <packageUrl regex="true">^pkg:maven/com\.azure/azure-(core|core-http-netty|identity|json)@.*$</packageUrl> <cve>CVE-2026-33117</cve> </suppress> @@ -978,20 +983,6 @@ <cve>CVE-2026-87795</cve> </suppress> - <suppress> - <!-- CVE-2026-90559/93452: OOB read/write in Snappy.uncompress/compress(ByteBuffer, ByteBuffer). - CVE-2026-108106: unbounded memory allocation during decompression (fixed in 1.1.10.9). - snappy-java is a transitive dependency (via Kafka, Parquet, etc.); Druid's own snappy - compression/decompression uses Apache Commons Compress, not the xerial ByteBuffer APIs. --> - <notes><![CDATA[ - file name: snappy-java-1.1.10.8.jar - ]]></notes> - <packageUrl regex="true">^pkg:maven/org\.xerial\.snappy/snappy-java@1\.1\.10\.8$</packageUrl> - <cve>CVE-2026-90559</cve> - <cve>CVE-2026-93452</cve> - <cve>CVE-2026-108106</cve> - </suppress> - <suppress> <!-- CVE-2026-82463: auth bypass in pac4j-core's CheckProfileTypeAuthorizer. Not used by Druid. CVE-2026-82461: pac4j-oidc fails to verify tokens when extracting Keycloak realm/client @@ -1037,4 +1028,36 @@ <cve>CVE-2026-47848</cve> <cve>CVE-2026-47843</cve> </suppress> + + <suppress> + <!-- CVE-2026-115448: False positive. ZooKeeper 3.8.8 contains the fix (ZOOKEEPER-5097, fix + versions 3.8.8, 3.9.7 and 3.10.0). The "Affected versions" header of the Apache advisory + says "3.8.0 through 3.8.8", but the advisory text says "3.8.0 through 3.8.7" and + recommends an upgrade to 3.8.8. The scanner uses the incorrect header. + See https://lists.apache.org/thread/p892jm8qw0zqv8z152lpokyt7mp6gc41 --> + <notes><![CDATA[ + file name: zookeeper-3.8.8.jar + ]]></notes> + <packageUrl regex="true">^pkg:maven/org\.apache\.zookeeper/zookeeper@3\.8\.8$</packageUrl> + <cve>CVE-2026-115448</cve> + </suppress> + + <suppress until="2027-04-30Z"> + <!-- CVE-2026-102554: unbounded allocation when Java deserialization reads a CompactHashMap, + CompactHashSet or MapMakerInternalMap. Fixed in Guava 33.7.2. + CVE-2026-118042: fixed in Guava 33.8.0. #20852 upgraded Druid's own Guava and the Guava + shaded in opentelemetry-emitter to 33.8.0, but it cannot change the copies that Hadoop ships. + These CVEs affect only the Guava copies that Hadoop shades and relocates into + hadoop-shaded-guava and hadoop-client-runtime. Hadoop RPC uses protobuf, not Java + serialization, and Druid does not use Java deserialization of Hadoop's relocated classes. + Remove when Hadoop ships a shaded Guava 33.8.0+. --> + <notes><![CDATA[ + file name: hadoop-shaded-guava-1.4.0.jar (shaded Guava 32.0.1) + hadoop-shaded-guava-1.5.0.jar (shaded Guava 33.4.8) + hadoop-client-runtime-3.5.0.jar (shaded Guava 33.4.8) + ]]></notes> + <filePath regex="true">.*/(hadoop-shaded-guava|hadoop-client-runtime)-[0-9][^/]*\.jar/META-INF/maven/com\.google\.guava/guava/pom\.xml$</filePath> + <cve>CVE-2026-102554</cve> + <cve>CVE-2026-118042</cve> + </suppress> </suppressions> diff --git a/pom.xml b/pom.xml index 0617c90288e..1784318abd6 100644 --- a/pom.xml +++ b/pom.xml @@ -135,7 +135,7 @@ <httpclient.version>4.5.14</httpclient.version> <okhttp.version>5.5.0</okhttp.version> <kubernetes.client.version>25.0.0-legacy</kubernetes.client.version> - <zookeeper.version>3.8.7</zookeeper.version> + <zookeeper.version>3.8.8</zookeeper.version> <checkerframework.version>4.3.0</checkerframework.version> <com.google.apis.client.version>2.7.2</com.google.apis.client.version> <com.google.http.client.apis.version>2.2.0</com.google.http.client.apis.version> @@ -419,7 +419,7 @@ <dependency> <groupId>net.minidev</groupId> <artifactId>json-smart</artifactId> - <version>2.6.0</version> + <version>2.6.1</version> </dependency> <!-- azure-core-http-netty 1.16.5 requires Reactor Core 3.7.19. --> <dependency> @@ -1026,7 +1026,7 @@ <dependency> <groupId>org.xerial.snappy</groupId> <artifactId>snappy-java</artifactId> - <version>1.1.10.8</version> + <version>1.1.10.12</version> </dependency> <dependency> <groupId>com.google.protobuf</groupId> @@ -1183,12 +1183,12 @@ <dependency> <groupId>org.ow2.asm</groupId> <artifactId>asm</artifactId> - <version>9.10.1</version> + <version>9.11.1</version> </dependency> <dependency> <groupId>org.ow2.asm</groupId> <artifactId>asm-commons</artifactId> - <version>9.10.1</version> + <version>9.11.1</version> </dependency> <dependency> <groupId>org.asynchttpclient</groupId> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
