Hi Akshay, Thanks for sharing the scan. I reviewed all four findings against the Druid 38.0.0 branch and current master (39.0.0-SNAPSHOT).
The results are: - CVE-2022-1471 — SnakeYAML 1.33 Current master removes this vulnerable transitive dependency from the Cassandra extension because it is only used by unused Cassandra server-configuration code. This was addressed in PR #19806 <https://github.com/apache/druid/pull/19806>. The fix is not included in Druid 38.0.0; the 38 branch still contains SnakeYAML 1.33. - PRISMA-2023-0067 — Jackson The finding has two paths. The Ranger/Hadoop path is addressed in Druid 38 through PR #19276 <https://github.com/apache/druid/pull/19276> and PR #19273 <https://github.com/apache/druid/pull/19273>, which use Ranger 2.8.0 and Hadoop 3.5.0. The Delta Lake path requires a separate fix. Druid 38 still uses Delta Kernel 3.2.1, which brings parquet-jackson 1.12.3. Current master resolves this through PR #20012 <https://github.com/apache/druid/pull/20012>, upgrading Delta Kernel to 4.3.1 and its Parquet dependency to 1.16.0. Therefore, this finding is only partially resolved in 38.0.0. - CVE-2023-44487 — Jetty The vulnerable Hadoop runtime versions 3.3.4/3.3.6 were replaced with Hadoop 3.5.0 through PR #19273 <https://github.com/apache/druid/pull/19273>. The finding is addressed in Druid 38.0.0 and current master. - CVE-2019-17571 — Log4j 1.x This is a scanner false positive for Druid. The finding is reported from ambari-metrics-common-2.7.0.0.0.jar, which contains embedded Log4j 1.2.17 Maven metadata. Inspection of the actual JAR found no Log4j 1.x classes, including SocketServer, and the Ambari extension source does not use Log4j 1 APIs. The scanner is identifying dependency metadata inside the upstream shaded artifact, not executable Log4j code. This CVE targets the Log4j 1 SocketServer component, as documented by Apache Log4j <https://logging.apache.org/log4j/1.x/>. The reported paths are all optional extensions. Removing them disables only Cassandra storage, Ambari metrics emission, Delta Lake support, or Ranger authorization; it does not affect Druid core functionality. The HDFS extension is not implicated by these four findings and does not need to be removed for this scan. Although these findings are against optional extension, my personal opinion is that we should NOT exclude them from docker image by default. Because what if we have CVEs in core extensions? We should have the same policy for both optional and core extensions. And for optional extensions, they're not loaded in the loadList by default, the risk is very low. Recently I set up a daily pipeline to resolve/approve/merge PRs from the dependabot so we can keep up to latest dependencies in the entire repo if newer dependencies are compatible. In the past month, about 160 PRs were merged across 200+ distinct artifacts. I think this pipeline can help ease CVEs across different dependencies. Thanks and regards. On Fri, Aug 21, 2026 at 6:38 PM Akshay Patel via dev <[email protected]> wrote: > Hi Apache Druid Dev Team, > > PRISMA tool has found common vulnerabilities and exposures (CVE) in Apache > druid extension. PRISMA did container image scan on Apache Druid v37 docker > image. We don’t require this extension so planning to remove it. There are > two option 1) remove extension from docker image 2) configuring druid > extension loading list appropriately. > > We are choosing option 1- remove below not required extensions from druid > docker image because druid extension loading configuration will enforce > exclusion at runtime not build time hence docker image would still have > those extensions and CVE’s. > > “RUN set -eux; > rm -rf > /opt/druid/extensions/druid-Cassandra-storage > /opt/druid/extensions/ambari-metrics-emitter > /opt/druid/extensions/druid-deltalake-extensions > /opt/druid/extensions/druid-hdfs-storage" > > *We believe extension removal from docker image would result into only > unavailability of extension functionality. Is there any impact on Apache > druid core functionality?* > > FYI, below are list of CVE’S > > CVE-2022-1471 > Package: org.yaml_snakeyaml > Path: /opt/druid/extensions/druid-cassandra-storage/snakeyaml-1.33.jar > - > CVE-2019-17571 > Package: log4j_log4j > Path: > /opt/druid/extensions/ambari-metrics-emitter/ambari-metrics-common-2.7.0.0.0.jar > > PRISMA-2023-0067 > Package name: com.fasterxml.jackson.core_jackson-core > Path: > /opt/druid/extensions/druid-deltalake-extensions/parquet-jackson-1.12.3.jar > Path: > /opt/druid/extensions/druid-ranger-security/hadoop-client-runtime-3.3.6.jar > > CVE-2023-44487 > Package name: org.eclipse.jetty_jetty-io > Path: > /opt/druid/extensions/druid-ranger-security/hadoop-client-runtime-3.3.6.jar > Path: > /opt/druid/extensions/druid-deltalake-extensions/hadoop-client-runtime-3.3.4.jar > > *Thanks,* > *Akshay Patel* > Lead Software Engineer > MDES Architecture > > Mastercard > Mastercard | India | Vadodara | mobile +91 9925925872 > <http://www.mastercard.com/> > CONFIDENTIALITY NOTICE This e-mail message and any attachments are only > for the use of the intended recipient and may contain information that is > privileged, confidential or exempt from disclosure under applicable law. If > you are not the intended recipient, any disclosure, distribution or other > use of this e-mail message or attachments is prohibited. If you have > received this e-mail message in error, please delete and notify the sender > immediately. Thank you. >
