[
https://issues.apache.org/jira/browse/HBASE-29812?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18051016#comment-18051016
]
Hudson commented on HBASE-29812:
--------------------------------
Results for branch master
[build #1392 on
builds.a.o|https://ci-hbase.apache.org/job/HBase%20Nightly/job/master/1392/]:
(x) *{color:red}-1 overall{color}*
----
details (if available):
(/) {color:green}+1 general checks{color}
-- For more information [see general
report|https://ci-hbase.apache.org/job/HBase%20Nightly/job/master/1392/General_20Nightly_20Build_20Report/]
(x) {color:red}-1 jdk17 hadoop3 checks{color}
-- For more information [see jdk17
report|https://ci-hbase.apache.org/job/HBase%20Nightly/job/master/1392/JDK17_20Nightly_20Build_20Report_20_28Hadoop3_29/]
(x) {color:red}-1 jdk17 hadoop 3.3.5 backward compatibility checks{color}
-- For more information [see jdk17
report|https://ci-hbase.apache.org/job/HBase%20Nightly/job/master/1392/JDK17_20Nightly_20Build_20Report_20_28Hadoop3_29/]
(x) {color:red}-1 jdk17 hadoop 3.3.6 backward compatibility checks{color}
-- For more information [see jdk17
report|https://ci-hbase.apache.org/job/HBase%20Nightly/job/master/1392/JDK17_20Nightly_20Build_20Report_20_28Hadoop3_29/]
(x) {color:red}-1 jdk17 hadoop 3.4.0 backward compatibility checks{color}
-- For more information [see jdk17
report|https://ci-hbase.apache.org/job/HBase%20Nightly/job/master/1392/JDK17_20Nightly_20Build_20Report_20_28Hadoop3_29/]
(/) {color:green}+1 jdk17 hadoop 3.4.1 backward compatibility checks{color}
-- For more information [see jdk17
report|https://ci-hbase.apache.org/job/HBase%20Nightly/job/master/1392/JDK17_20Nightly_20Build_20Report_20_28Hadoop3_29/]
(/) {color:green}+1 source release artifact{color}
-- See build output for details.
(/) {color:green}+1 client integration test for 3.3.5 {color}
(/) {color:green}+1 client integration test for 3.3.6 {color}
(/) {color:green}+1 client integration test for 3.4.0 {color}
(/) {color:green}+1 client integration test for 3.4.1 {color}
(/) {color:green}+1 client integration test for 3.4.2 {color}
> Bump qs and valibot to fix high security vulnerability in hbase-website
> -----------------------------------------------------------------------
>
> Key: HBASE-29812
> URL: https://issues.apache.org/jira/browse/HBASE-29812
> Project: HBase
> Issue Type: Task
> Components: website
> Reporter: Dávid Paksy
> Assignee: Dávid Paksy
> Priority: Major
> Labels: pull-request-available
>
> Dependabot found a high CVE in qs <6.14.1:
> [https://github.com/apache/hbase/security/dependabot/117]
> npm audit also found another high CVE in valibot 0.31.0 - 1.1.0.
> These are dependencies (npm packages) of the hbase-website module.
> h2. Before the fix
> {code:java}
> $ npm audit
> # npm audit report
> qs <6.14.1
> Severity: high
> qs's arrayLimit bypass in its bracket notation allows DoS via memory
> exhaustion - https://github.com/advisories/GHSA-6rw7-vpxm-498p
> fix available via `npm audit fix`
> node_modules/express/node_modules/qs
> node_modules/qs
> body-parser <=1.20.3 || 2.0.0-beta.1 - 2.0.2
> Depends on vulnerable versions of qs
> node_modules/body-parser
> valibot 0.31.0 - 1.1.0
> Severity: high
> Valibot has a ReDoS vulnerability in `EMOJI_REGEX` -
> https://github.com/advisories/GHSA-vqpr-j7v3-hqw9
> fix available via `npm audit fix`
> node_modules/valibot
> 3 high severity vulnerabilities
> To address all issues, run:
> npm audit fix
> {code}
> h2.After fix
> {code:java}
> npm audit fix
> added 798 packages, and audited 799 packages in 5s
> 288 packages are looking for funding
> run `npm fund` for details
> found 0 vulnerabilities
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
