Hi Apache Druid Dev Team, PRISMA tool has found common vulnerabilities and exposures (CVE) in Apache druid extension. PRISMA did container image scan on Apache Druid v37 docker image. We don’t require this extension so planning to remove it. There are two option 1) remove extension from docker image 2) configuring druid extension loading list appropriately.
We are choosing option 1- remove below not required extensions from druid docker image because druid extension loading configuration will enforce exclusion at runtime not build time hence docker image would still have those extensions and CVE’s. “RUN set -eux; rm -rf /opt/druid/extensions/druid-Cassandra-storage /opt/druid/extensions/ambari-metrics-emitter /opt/druid/extensions/druid-deltalake-extensions /opt/druid/extensions/druid-hdfs-storage" We believe extension removal from docker image would result into only unavailability of extension functionality. Is there any impact on Apache druid core functionality? FYI, below are list of CVE’S CVE-2022-1471 Package: org.yaml_snakeyaml Path: /opt/druid/extensions/druid-cassandra-storage/snakeyaml-1.33.jar - CVE-2019-17571 Package: log4j_log4j Path: /opt/druid/extensions/ambari-metrics-emitter/ambari-metrics-common-2.7.0.0.0.jar PRISMA-2023-0067 Package name: com.fasterxml.jackson.core_jackson-core Path: /opt/druid/extensions/druid-deltalake-extensions/parquet-jackson-1.12.3.jar Path: /opt/druid/extensions/druid-ranger-security/hadoop-client-runtime-3.3.6.jar CVE-2023-44487 Package name: org.eclipse.jetty_jetty-io Path: /opt/druid/extensions/druid-ranger-security/hadoop-client-runtime-3.3.6.jar Path: /opt/druid/extensions/druid-deltalake-extensions/hadoop-client-runtime-3.3.4.jar Thanks, Akshay Patel Lead Software Engineer MDES Architecture Mastercard Mastercard | India | Vadodara | mobile +91 9925925872 [cid:22719553-EBCE-4658-ACFA-5A04A7D2A974]<http://www.mastercard.com/> CONFIDENTIALITY NOTICE This e-mail message and any attachments are only for the use of the intended recipient and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If you are not the intended recipient, any disclosure, distribution or other use of this e-mail message or attachments is prohibited. If you have received this e-mail message in error, please delete and notify the sender immediately. Thank you.
