Apache
/
druid
mirror of https://github.com/apache/druid.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
druid/owasp-dependency-check-supp...

623 lines
24 KiB
XML
Raw Normal View History

Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<?xml version="1.0" encoding="UTF-8"?>
<!--
~ Licensed to the Apache Software Foundation (ASF) under one
~ or more contributor license agreements. See the NOTICE file
~ distributed with this work for additional information
~ regarding copyright ownership. The ASF licenses this file
~ to you under the Apache License, Version 2.0 (the
~ "License"); you may not use this file except in compliance
~ with the License. You may obtain a copy of the License at
~
~ http://www.apache.org/licenses/LICENSE-2.0
~
~ Unless required by applicable law or agreed to in writing,
~ software distributed under the License is distributed on an
~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
~ KIND, either express or implied. See the License for the
~ specific language governing permissions and limitations
~ under the License.
-->
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
<suppress>
<!-- druid-indexing-hadoop.jar is mistaken for hadoop -->
<notes><![CDATA[
Remove druid incubating references (#9405)
2020-02-27 00:47:58 -05:00
file name: org.apache.druid:druid-indexing-hadoop
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.druid/druid\-indexing\-hadoop@.*$</packageUrl>
<cve>CVE-2012-4449</cve>
<cve>CVE-2017-3162</cve>
suppress false positive cve (#11699) * suppress false positive cve * update comment, dont run tests on changes to owasp-dependency-check-suppressions.xml
2021-09-13 23:45:38 -04:00
<cve>CVE-2018-8009</cve>
Suppress false CVE on druid-indexing-hadoop artifact (#12562)
2022-05-24 06:30:58 -04:00
<cve>CVE-2022-26612</cve>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
</suppress>
<suppress>
<!-- druid-processing.jar is mistaken for org.processing:processing -->
<notes><![CDATA[
Remove druid incubating references (#9405)
2020-02-27 00:47:58 -05:00
file name: org.apache.druid:druid-processing
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.druid/druid\-processing@.*$</packageUrl>
<cve>CVE-2018-1000840</cve>
</suppress>
<suppress>
<!-- These CVEs are for the python SDK, but Druid uses the Java SDK -->
<notes><![CDATA[
Suppress CVEs for htrace-core4 and openstack-swift (#9489) CVE-2013-7109 can be ignored for openstack-swift as it is for the python SDK and druid uses the java SDK. The jackson-databind:2.4.0 CVEs via htrace-core4 are all suppressed for now as fixing them requires updating the hadoop version.
2020-03-10 13:55:41 -04:00
file name: openstack-swift
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.jclouds\.api/openstack\-swift@.*$</packageUrl>
Suppress CVEs for htrace-core4 and openstack-swift (#9489) CVE-2013-7109 can be ignored for openstack-swift as it is for the python SDK and druid uses the java SDK. The jackson-databind:2.4.0 CVEs via htrace-core4 are all suppressed for now as fixing them requires updating the hadoop version.
2020-03-10 13:55:41 -04:00
<cve>CVE-2013-7109</cve>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<cve>CVE-2016-0737</cve>
<cve>CVE-2016-0738</cve>
<cve>CVE-2017-16613</cve>
</suppress>
<suppress>
<!-- These CVEs are for the python SDK, but Druid uses the Java SDK -->
<notes><![CDATA[
file name: openstack-keystone-1.9.3.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.jclouds\.api/openstack\-keystone@.*$</packageUrl>
<cve>CVE-2015-7546</cve>
Suppress CVEs for openstack-keystone (#9903) CVE-2020-12689, CVE-2020-12691, and CVE-2020-12690 can be ignored for openstack-keystone as they are for the python SDK and druid uses the java SDK.
2020-05-22 13:32:17 -04:00
<cve>CVE-2020-12689</cve>
<cve>CVE-2020-12690</cve>
<cve>CVE-2020-12691</cve>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
</suppress>
Suppress CVE-2021-27568 from json-smart 2.3 dependency (#11438) Dependency on hadoop 2.8.5 is preventing us form updating this dependency to a later version. We don't believe that this is a major concern since Druid eats uncaught exceptions, and only displays them in logs. This issue also should only affect ingestion jobs, which can only be run by admin type users.
2021-07-12 22:58:06 -04:00
<suppress>
<!--
~ CVE-2021-27568:
~ dependency on hadoop 2.8.5 is blocking us from updating this dependency. Not a major concern since Druid
~ eats uncaught exceptions, and only displays them in logs. This issue also should only affect ingestion
~ jobs which can only be run by admin type users.
-->
<notes><![CDATA[
file name: json-smart-2.3.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/net\.minidev/json\-smart@.*$</packageUrl>
<cve>CVE-2021-27568</cve>
Suppress CVEs (#12590)
2022-06-01 11:52:32 -04:00
<cve>CVE-2021-31684</cve>
Suppress CVE-2021-27568 from json-smart 2.3 dependency (#11438) Dependency on hadoop 2.8.5 is preventing us form updating this dependency to a later version. We don't believe that this is a major concern since Druid eats uncaught exceptions, and only displays them in logs. This issue also should only affect ingestion jobs, which can only be run by admin type users.
2021-07-12 22:58:06 -04:00
</suppress>
Suppress some false alarm CVEs (#12812) This commit suppresses the following CVEs: - CVE-2021-43138: false alarm for async-http-client - CVE-2021-34538: applicable to Hive server - CVE-2020-25638: requires hibernate update, which causes Hadoop ingestion failure - CVE-2021-27568: false alarm for accessors-smart which is a dependency of json-smart (already suppressed)
2022-07-22 12:57:31 -04:00
<suppress>
<!--
accessors-smart-1.2 is a dependency of json-smart-2.3.
owasp seems to flag this too against CVE-2021-27568 for some reason.
This can be fixed only when json-smart is upgraded.
-->
<notes><![CDATA[
file name: accessors-smart-1.2.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/net\.minidev/accessors\-smart@.*$</packageUrl>
<cve>CVE-2021-27568</cve>
</suppress>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
Address CVE-2020-8570, suppress CVE-2020-8554 (#10826) * Address CVE-2020-8570, suppress CVE-2020-8554 * Update licenses.yaml
2021-02-03 18:17:06 -05:00
<suppress>
<!-- Not much for us to do as a user of the client lib, and no patch is available,
see https://github.com/kubernetes/kubernetes/issues/97076 -->
<notes><![CDATA[
file name: client-java-10.0.1.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/io\.kubernetes/client\-java.*@10.0.1$</packageUrl>
<cve>CVE-2020-8554</cve>
</suppress>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<!-- FIXME: These are suppressed so that CI can enforce that no new vulnerable dependencies are added. -->
<suppress>
<!--
~ TODO: Fix by updating hibernate-validator.
~ Note hibernate-validator:5.3.1 introduces a change that requires an EL implementation to be in the classpath:
~ https://developer.jboss.org/wiki/HibernateValidatorMigrationGuide#jive_content_id_531Final
~
~ For example, updating hibernate-validator causes hadoop ingestion tasks to fail:
~
~ Error: com.google.inject.CreationException: Unable to create injector, see the following errors:
~
~ 1) An exception was caught and reported. Message: HV000183: Unable to initialize 'javax.el.ExpressionFactory'. Check that you have the EL dependencies on the classpath, or use ParameterMessageInterpolator instead
~ at com.google.inject.internal.InjectorShell$Builder.build(InjectorShell.java:138)
~
~ 2) No implementation for javax.validation.Validator was bound.
~ at org.apache.druid.guice.ConfigModule.configure(ConfigModule.java:39)
~
~ 2 errors
~ at com.google.inject.internal.Errors.throwCreationExceptionIfErrorsExist(Errors.java:470)
~ at com.google.inject.internal.InternalInjectorCreator.initializeStatically(InternalInjectorCreator.java:155)
~ at com.google.inject.internal.InternalInjectorCreator.build(InternalInjectorCreator.java:107)
~ at com.google.inject.Guice.createInjector(Guice.java:99)
~ at com.google.inject.Guice.createInjector(Guice.java:73)
~ at org.apache.druid.guice.GuiceInjectors.makeStartupInjector(GuiceInjectors.java:56)
~ at org.apache.druid.indexer.HadoopDruidIndexerConfig.<clinit>(HadoopDruidIndexerConfig.java:102)
~ at org.apache.druid.indexer.HadoopDruidIndexerMapper.setup(HadoopDruidIndexerMapper.java:53)
~ at org.apache.druid.indexer.DetermineHashedPartitionsJob$DetermineCardinalityMapper.setup(DetermineHashedPartitionsJob.java:279)
~ at org.apache.druid.indexer.DetermineHashedPartitionsJob$DetermineCardinalityMapper.run(DetermineHashedPartitionsJob.java:334)
~ at org.apache.hadoop.mapred.MapTask.runNewMapper(MapTask.java:787)
~ at org.apache.hadoop.mapred.MapTask.run(MapTask.java:341)
~ at org.apache.hadoop.mapred.YarnChild$2.run(YarnChild.java:175)
~ at java.security.AccessController.doPrivileged(Native Method)
~ at javax.security.auth.Subject.doAs(Subject.java:422)
~ at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1844)
~ at org.apache.hadoop.mapred.YarnChild.main(YarnChild.java:169)
~ Caused by: javax.validation.ValidationException: HV000183: Unable to initialize 'javax.el.ExpressionFactory'. Check that you have the EL dependencies on the classpath, or use ParameterMessageInterpolator instead
~ at org.hibernate.validator.messageinterpolation.ResourceBundleMessageInterpolator.buildExpressionFactory(ResourceBundleMessageInterpolator.java:102)
~ at org.hibernate.validator.messageinterpolation.ResourceBundleMessageInterpolator.<init>(ResourceBundleMessageInterpolator.java:45)
~ at org.hibernate.validator.internal.engine.ConfigurationImpl.getDefaultMessageInterpolator(ConfigurationImpl.java:423)
~ at org.hibernate.validator.internal.engine.ConfigurationImpl.getDefaultMessageInterpolatorConfiguredWithClassLoader(ConfigurationImpl.java:575)
~ at org.hibernate.validator.internal.engine.ConfigurationImpl.getMessageInterpolator(ConfigurationImpl.java:364)
~ at org.hibernate.validator.internal.engine.ValidatorFactoryImpl.<init>(ValidatorFactoryImpl.java:148)
~ at org.hibernate.validator.HibernateValidator.buildValidatorFactory(HibernateValidator.java:38)
~ at org.hibernate.validator.internal.engine.ConfigurationImpl.buildValidatorFactory(ConfigurationImpl.java:331)
~ at javax.validation.Validation.buildDefaultValidatorFactory(Validation.java:110)
~ at org.apache.druid.guice.ConfigModule.configure(ConfigModule.java:39)
~ at com.google.inject.spi.Elements$RecordingBinder.install(Elements.java:340)
~ at com.google.inject.spi.Elements.getElements(Elements.java:110)
~ at com.google.inject.internal.InjectorShell$Builder.build(InjectorShell.java:138)
~ at com.google.inject.internal.InternalInjectorCreator.build(InternalInjectorCreator.java:104)
~ ... 14 more
~ Caused by: java.lang.NoSuchMethodError: javax.el.ExpressionFactory.newInstance()Ljavax/el/ExpressionFactory;
~ at org.hibernate.validator.messageinterpolation.ResourceBundleMessageInterpolator.buildExpressionFactory(ResourceBundleMessageInterpolator.java:98)
~ ... 27 more
-->
<notes><![CDATA[
file name: hibernate-validator-5.2.5.Final.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.hibernate/hibernate\-validator@.*$</packageUrl>
<cve>CVE-2017-7536</cve>
Suppress some false alarm CVEs (#12812) This commit suppresses the following CVEs: - CVE-2021-43138: false alarm for async-http-client - CVE-2021-34538: applicable to Hive server - CVE-2020-25638: requires hibernate update, which causes Hadoop ingestion failure - CVE-2021-27568: false alarm for accessors-smart which is a dependency of json-smart (already suppressed)
2022-07-22 12:57:31 -04:00
<cve>CVE-2020-25638</cve>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
</suppress>
<suppress>
<!-- TODO: Fix by updating curator-x-discovery to > 4.2.0 and updating hadoop -->
<notes><![CDATA[
file name: jackson-mapper-asl-1.9.13.jar
]]></notes>
Suppress CVEs for jackson-mapper-asl:1.9.13 (#9604) The jackson-mapper-asl:1.9.13 CVEs via curator-x-discovery are all suppressed for now as fixing them requires updating the curator version.
2020-04-03 13:33:52 -04:00
<packageUrl regex="true">^pkg:maven/org\.codehaus\.jackson/jackson\-mapper\-asl@1.9.13$</packageUrl>
<cvssBelow>10</cvssBelow> <!-- suppress all CVEs for jackson-mapper-asl:1.9.13 ince it is via curator-x-discovery -->
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
</suppress>
<suppress>
<!-- TODO: Fix by updating org.apache.druid.java.util.http.client.NettyHttpClient to use netty 4 -->
<notes><![CDATA[
file name: netty-3.10.6.Final.jar
]]></notes>
Suppress CVEs for htrace-core4 and openstack-swift (#9489) CVE-2013-7109 can be ignored for openstack-swift as it is for the python SDK and druid uses the java SDK. The jackson-databind:2.4.0 CVEs via htrace-core4 are all suppressed for now as fixing them requires updating the hadoop version.
2020-03-10 13:55:41 -04:00
<packageUrl regex="true">^pkg:maven/io\.netty/netty@3.10.6.Final$</packageUrl>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<cve>CVE-2019-16869</cve>
Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 (#9300) * Suppress netty 3 vulnerabilites and upgrade netty 4 version * Upgrade netty 4 version to fix vulnerabilities CVE-2019-20445 and CVE-2019-20444 * suppress these CVEs for netty 3 * * simplify suppression xml file * update licenses file with new version of netty * * fix type in licenses.yaml
2020-01-31 17:51:54 -05:00
<cve>CVE-2019-20444</cve>
<cve>CVE-2019-20445</cve>
Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 (#11844) * bump netty4 to 4.1.68 * suppress CVE-2021-37136 and CVE-2021-37137 for netty3 * license
2021-10-26 00:09:15 -04:00
<cve>CVE-2021-37136</cve>
<cve>CVE-2021-37137</cve>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
</suppress>
<suppress>
<!-- TODO: Fix by upgrading hadoop-auth version -->
<notes><![CDATA[
file name: nimbus-jose-jwt-4.41.1.jar
]]></notes>
Suppress CVEs for htrace-core4 and openstack-swift (#9489) CVE-2013-7109 can be ignored for openstack-swift as it is for the python SDK and druid uses the java SDK. The jackson-databind:2.4.0 CVEs via htrace-core4 are all suppressed for now as fixing them requires updating the hadoop version.
2020-03-10 13:55:41 -04:00
<packageUrl regex="true">^pkg:maven/com\.nimbusds/nimbus\-jose\-jwt@4.41.1$</packageUrl>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<cve>CVE-2019-17195</cve>
</suppress>
Suppressing false positive CVE-2020-7791 (#11215) * suppressing false positive CVE-2020-7791 * add comments
2021-05-06 18:24:12 -04:00
<suppress>
<!-- This CVE is a false positive. The CVE is not for apacheds-i18n -->
<notes><![CDATA[
file name: apacheds-i18n-2.0.0-M15.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.directory\.server/apacheds\-i18n@.*$</packageUrl>
<cve>CVE-2020-7791</cve>
</suppress>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<suppress>
Ignore CVEs from htrace and ambari transitive deps (#10353) * Ignore CVEs from htrace and ambari transitive deps htrace CVEs are suppressed for now as addressing them requires updating the hadoop version. ambari CVEs are suppressed for now since ambari is updated to the latest version and is no longer actively maintained. * Fix compilation issue from ambari upgrade * Add missing test coverage
2020-09-04 18:22:26 -04:00
<!-- TODO: Fix by using com.datastax.oss:java-driver-core instead of com.netflix.astyanax:astyanax in extensions-contrib/cassandra-storage -->
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<notes><![CDATA[
file name: libthrift-0.6.1.jar
]]></notes>
Suppress CVEs for htrace-core4 and openstack-swift (#9489) CVE-2013-7109 can be ignored for openstack-swift as it is for the python SDK and druid uses the java SDK. The jackson-databind:2.4.0 CVEs via htrace-core4 are all suppressed for now as fixing them requires updating the hadoop version.
2020-03-10 13:55:41 -04:00
<packageUrl regex="true">^pkg:maven/org\.apache\.thrift/libthrift@0.6.1$</packageUrl>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<cve>CVE-2016-5397</cve>
<cve>CVE-2018-1320</cve>
<cve>CVE-2019-0205</cve>
</suppress>
Ignore CVEs from htrace and ambari transitive deps (#10353) * Ignore CVEs from htrace and ambari transitive deps htrace CVEs are suppressed for now as addressing them requires updating the hadoop version. ambari CVEs are suppressed for now since ambari is updated to the latest version and is no longer actively maintained. * Fix compilation issue from ambari upgrade * Add missing test coverage
2020-09-04 18:22:26 -04:00
<suppress>
<!-- TODO: Fix by using com.datastax.oss:java-driver-core instead of com.netflix.astyanax:astyanax in extensions-contrib/cassandra-storage -->
<notes><![CDATA[
file name: snakeyaml-1.6.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@1.6$</packageUrl>
<cve>CVE-2017-18640</cve>
</suppress>
<suppress>
<notes><![CDATA[
file name: htrace-core4-4.0.1-incubating.jar (shaded: com.fasterxml.jackson.core:jackson-annotations:2.4.0)
]]></notes>
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-annotations@2.4.0$</packageUrl>
<cvssBelow>10</cvssBelow> <!-- suppress all CVEs for jackson-annotations:2.4.0 since it is via htrace-core4 -->
</suppress>
<suppress>
<notes><![CDATA[
file name: htrace-core4-4.0.1-incubating.jar (shaded: com.fasterxml.jackson.core:jackson-core:2.4.0)
]]></notes>
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-core@2.4.0$</packageUrl>
<cvssBelow>10</cvssBelow> <!-- suppress all CVEs for jackson-core:2.4.0 since it is via htrace-core4 -->
</suppress>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<suppress>
<!--
~ TODO: Fix by updating hadoop-common used by extensions-core/parquet-extensions. Possibly need to change
~ HdfsStorageDruidModule.configure()->FileSystem.get(conf) as well.
-->
<notes><![CDATA[
file name: htrace-core4-4.0.1-incubating.jar (shaded: com.fasterxml.jackson.core:jackson-databind:2.4.0)
]]></notes>
Suppress CVEs for htrace-core4 and openstack-swift (#9489) CVE-2013-7109 can be ignored for openstack-swift as it is for the python SDK and druid uses the java SDK. The jackson-databind:2.4.0 CVEs via htrace-core4 are all suppressed for now as fixing them requires updating the hadoop version.
2020-03-10 13:55:41 -04:00
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@2.4.0$</packageUrl>
<cve>CVE-2018-14721</cve> <!-- cvss of 10.0 -->
<cvssBelow>10</cvssBelow> <!-- suppress all CVEs for jackson-databind:2.4.0 since it is via htrace-core4 -->
</suppress>
<suppress>
<!--
~ TODO: Fix by updating parquet version in extensions-core/parquet-extensions.
-->
<notes><![CDATA[
Ignore CVEs from htrace and ambari transitive deps (#10353) * Ignore CVEs from htrace and ambari transitive deps htrace CVEs are suppressed for now as addressing them requires updating the hadoop version. ambari CVEs are suppressed for now since ambari is updated to the latest version and is no longer actively maintained. * Fix compilation issue from ambari upgrade * Add missing test coverage
2020-09-04 18:22:26 -04:00
file name: parquet-jackson-1.11.0.jar (shaded: com.fasterxml.jackson.core:jackson-{core,databind}:2.9.10)
Suppress CVEs for htrace-core4 and openstack-swift (#9489) CVE-2013-7109 can be ignored for openstack-swift as it is for the python SDK and druid uses the java SDK. The jackson-databind:2.4.0 CVEs via htrace-core4 are all suppressed for now as fixing them requires updating the hadoop version.
2020-03-10 13:55:41 -04:00
]]></notes>
Ignore CVEs from htrace and ambari transitive deps (#10353) * Ignore CVEs from htrace and ambari transitive deps htrace CVEs are suppressed for now as addressing them requires updating the hadoop version. ambari CVEs are suppressed for now since ambari is updated to the latest version and is no longer actively maintained. * Fix compilation issue from ambari upgrade * Add missing test coverage
2020-09-04 18:22:26 -04:00
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-.*@2.9.10$</packageUrl>
<cvssBelow>10</cvssBelow> <!-- suppress all CVEs for jackson-{core,databind}:2.9.0 since it is via parquet transitive dependencies -->
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
</suppress>
Suppress CWE-400 for node-sass:4.13.1 (#9517) The vulnerability is fixed in 4.13.1: https://github.com/sass/node-sass/issues/2816#issuecomment-575136455 But the dependency check plugin thinks its still broken as the affected/fixed versions has not been updated yet on Sonatype OSS Index: https://ossindex.sonatype.org/vuln/c97f4ae7-be1f-4f71-b238-7c095b126e74
2020-03-16 12:42:33 -04:00
<suppress>
<notes><![CDATA[
file name: node-sass:4.13.1
The vulnerability is fixed in 4.13.1: https://github.com/sass/node-sass/issues/2816#issuecomment-575136455
But the dependency check plugin thinks it's still broken as the affected/fixed versions has not been updated on
Sonatype OSS Index: https://ossindex.sonatype.org/vuln/c97f4ae7-be1f-4f71-b238-7c095b126e74
]]></notes>
<packageUrl regex="true">^pkg:npm/node\-sass@.*$</packageUrl>
<vulnerabilityName>CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')</vulnerabilityName>
</suppress>
Suppress CVE-2020-7692 (#10214) Druid is not a native app, so this CVE should not apply.
2020-07-27 13:52:44 -04:00
<suppress>
<notes><![CDATA[
Druid is not a native app, so the vulnerability flagged is a false positive.
]]></notes>
<packageUrl regex="true">^pkg:maven/com\.google\.oauth-client/google\-oauth\-client@.*$</packageUrl>
<cve>CVE-2020-7692</cve>
Suppress CVEs (#12553)
2022-05-23 03:05:23 -04:00
<cve>CVE-2021-22573</cve>
Suppress CVE-2020-7692 (#10214) Druid is not a native app, so this CVE should not apply.
2020-07-27 13:52:44 -04:00
</suppress>
Document possible vulnerabilities for the druid-ranger-security (#9649) * Document possible vulnerabilities for the druid-ranger-security In certain configurations the ranger plugin can expose vulnerabilities due to some of its dependencies having CVEs. * Spelling checker is a bit tight
2020-04-09 13:43:11 -04:00
<suppress>
<!--
~ TODO: Fix when Apache Ranger 2.1 is released
-->
<notes><![CDATA[
file name: kafka_2.11-2.0.0.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.kafka/kafka_2.11@2.0.0$</packageUrl>
<cve>CVE-2019-12399</cve>
<cve>CVE-2018-17196</cve>
</suppress>
Suppress CVEs for jdom2, kafka-clients, libthrift, solr-solrj (#11572)
2021-08-11 06:16:57 -04:00
<suppress>
<!--
~ TODO: Fix when Apache Ranger 2.1 is released
- transitive dep from apache-ranger, upgrading to 2.1.0 adds other CVEs, staying at ranger 2.0.0 for now
-->
<notes><![CDATA[
file name: kafka-clients-2.0.0.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.kafka/kafka-clients@2.0.0$</packageUrl>
<cve>CVE-2019-12399</cve>
<cve>CVE-2018-17196</cve>
</suppress>
Document possible vulnerabilities for the druid-ranger-security (#9649) * Document possible vulnerabilities for the druid-ranger-security In certain configurations the ranger plugin can expose vulnerabilities due to some of its dependencies having CVEs. * Spelling checker is a bit tight
2020-04-09 13:43:11 -04:00
<suppress>
<!--
~ TODO: Fix when Apache Ranger is released with updated log4j
-->
<notes><![CDATA[
file name: log4j-1.2.17.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/log4j/log4j@1.2.17$</packageUrl>
<cve>CVE-2019-17571</cve>
Suppress CVEs (#12553)
2022-05-23 03:05:23 -04:00
<cve>CVE-2021-4104</cve>
<cve>CVE-2020-9493</cve>
<cve>CVE-2022-23307</cve>
<cve>CVE-2022-23305</cve>
<cve>CVE-2022-23302</cve>
Document possible vulnerabilities for the druid-ranger-security (#9649) * Document possible vulnerabilities for the druid-ranger-security In certain configurations the ranger plugin can expose vulnerabilities due to some of its dependencies having CVEs. * Spelling checker is a bit tight
2020-04-09 13:43:11 -04:00
</suppress>
Suppress CVE-2022-33915 (#12740)
2022-07-04 13:18:08 -04:00
<suppress>
<notes><![CDATA[
file name: log4j-core-2.17.1.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1$</packageUrl>
<cve>CVE-2022-33915</cve>
</suppress>
Ignore CVEs from htrace and ambari transitive deps (#10353) * Ignore CVEs from htrace and ambari transitive deps htrace CVEs are suppressed for now as addressing them requires updating the hadoop version. ambari CVEs are suppressed for now since ambari is updated to the latest version and is no longer actively maintained. * Fix compilation issue from ambari upgrade * Add missing test coverage
2020-09-04 18:22:26 -04:00
<suppress>
Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 (#11844) * bump netty4 to 4.1.68 * suppress CVE-2021-37136 and CVE-2021-37137 for netty3 * license
2021-10-26 00:09:15 -04:00
<!--
- TODO: The lastest version of ambari-metrics-common is 2.7.0.0.0, released in July 2018.
-->
<notes><![CDATA[
file name: ambari-metrics-common-2.7.0.0.0.jar (shaded: io.netty:netty:3.10.5.Final)
]]></notes>
<packageUrl regex="true">^pkg:maven/io\.netty/netty@3.10.5.Final$</packageUrl>
<cve>CVE-2019-16869</cve>
<cve>CVE-2019-20444</cve>
<cve>CVE-2019-20445</cve>
<cve>CVE-2021-37136</cve>
<cve>CVE-2021-37137</cve>
CVE suppression (#12535)
2022-05-19 01:51:48 -04:00
<cve>CVE-2021-4104</cve>
<cve>CVE-2020-9493</cve>
<cve>CVE-2022-23307</cve>
<cve>CVE-2022-23305</cve>
<cve>CVE-2022-23302</cve>
Ignore CVEs from htrace and ambari transitive deps (#10353) * Ignore CVEs from htrace and ambari transitive deps htrace CVEs are suppressed for now as addressing them requires updating the hadoop version. ambari CVEs are suppressed for now since ambari is updated to the latest version and is no longer actively maintained. * Fix compilation issue from ambari upgrade * Add missing test coverage
2020-09-04 18:22:26 -04:00
</suppress>
<suppress>
<!--
- TODO: The lastest version of ambari-metrics-common is 2.7.0.0.0, released in July 2018.
-->
<notes><![CDATA[
file name: ambari-metrics-common-2.7.0.0.0.jar (shaded: org.apache.hadoop:hadoop-annotations:2.6.0)
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.hadoop/hadoop\-annotations@.*$</packageUrl>
<cve>CVE-2015-1776</cve>
<cve>CVE-2016-3086</cve>
<cve>CVE-2016-5393</cve>
<cve>CVE-2016-6811</cve>
<cve>CVE-2017-3162</cve>
<cve>CVE-2018-11768</cve>
<cve>CVE-2018-1296</cve>
<cve>CVE-2018-8009</cve>
<cve>CVE-2018-8029</cve>
</suppress>
Suppress CVE-2018-11765 for hadoop dependencies (#10485)
2020-10-08 00:55:34 -04:00
<suppress>
Supress CVE 2022 26612 (#12463) * supress CVE-2022-26612 * adding packageUrl * suppressing CVE-2022-26612 * adding packageUrl * moving to hadoop section
2022-04-21 11:48:20 -04:00
<!-- Suppress cves that aren't applicable to hadoop client -->
Suppress CVE-2018-11765 for hadoop dependencies (#10485)
2020-10-08 00:55:34 -04:00
<notes><![CDATA[
file name: hadoop-*-2.8.5.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.hadoop/hadoop\-.*@.*$</packageUrl>
<cve>CVE-2018-11765</cve>
Suppress CVE-2020-9492 for hadoop-mapreduce-client-core (#10847)
2021-02-03 18:54:25 -05:00
<cve>CVE-2020-9492</cve>
Suppressing CVE-2022-25168 - hadoop-common-2.8.5.jar (#12970)
2022-08-25 06:32:17 -04:00
<cve>CVE-2022-25168</cve>
Supress CVE 2022 26612 (#12463) * supress CVE-2022-26612 * adding packageUrl * suppressing CVE-2022-26612 * adding packageUrl * moving to hadoop section
2022-04-21 11:48:20 -04:00
<cve>CVE-2022-26612</cve>
Suppress CVEs (#12590)
2022-06-01 11:52:32 -04:00
<cve>CVE-2018-8009</cve>
Suppress CVE-2018-11765 for hadoop dependencies (#10485)
2020-10-08 00:55:34 -04:00
</suppress>
Support for hadoop 3 via maven profiles (#11794) Add support for hadoop 3 profiles . Most of the details are captured in #11791 . We use a combination of maven profiles and resource filtering to achieve this. Hadoop2 is supported by default and a new maven profile with the name hadoop3 is created. This will allow the user to choose the profile which is best suited for the use case.
2021-10-30 13:16:24 -04:00
<suppress>
<notes><![CDATA[
file name: hadoop-*-3.3.1.jar
]]></notes>
<cve>CVE-2018-11765</cve>
<cve>CVE-2020-9492</cve>
Add CVEs for Hadoop3 (#12336) * Add CVEs * Move CVEs under hadoop3 section
2022-06-22 04:42:17 -04:00
<cve>CVE-2021-31684</cve>
<cve>CVE-2021-35517</cve>
<cve>CVE-2021-35516</cve>
<cve>CVE-2021-35515</cve>
<cve>CVE-2021-36090</cve>
Support for hadoop 3 via maven profiles (#11794) Add support for hadoop 3 profiles . Most of the details are captured in #11791 . We use a combination of maven profiles and resource filtering to achieve this. Hadoop2 is supported by default and a new maven profile with the name hadoop3 is created. This will allow the user to choose the profile which is best suited for the use case.
2021-10-30 13:16:24 -04:00
</suppress>
Suppress CVE-2017-15288 and upgrade bcprov-ext-jdk15o (#10933)
2021-03-02 19:18:27 -05:00
<suppress>
suppress kafka-clients CVE (#11562) The CVE details are here - https://nvd.nist.gov/vuln/detail/CVE-2021-26291. I am marking it suppressed since we are only using kafka-clients jar in druid. We use maven-artifact jar ourselves but it is only used for comparing versions
2021-08-09 09:32:25 -04:00
<!-- The CVE is not applicable to kafka-clients. -->
Suppress CVE-2017-15288 and upgrade bcprov-ext-jdk15o (#10933)
2021-03-02 19:18:27 -05:00
<notes><![CDATA[
suppress kafka-clients CVE (#11562) The CVE details are here - https://nvd.nist.gov/vuln/detail/CVE-2021-26291. I am marking it suppressed since we are only using kafka-clients jar in druid. We use maven-artifact jar ourselves but it is only used for comparing versions
2021-08-09 09:32:25 -04:00
file name: kafka-clients-2.8.0.jar
Suppress CVE-2017-15288 and upgrade bcprov-ext-jdk15o (#10933)
2021-03-02 19:18:27 -05:00
]]></notes>
suppress kafka-clients CVE (#11562) The CVE details are here - https://nvd.nist.gov/vuln/detail/CVE-2021-26291. I am marking it suppressed since we are only using kafka-clients jar in druid. We use maven-artifact jar ourselves but it is only used for comparing versions
2021-08-09 09:32:25 -04:00
<cve>CVE-2021-26291</cve>
Suppress CVE-2017-15288 and upgrade bcprov-ext-jdk15o (#10933)
2021-03-02 19:18:27 -05:00
</suppress>
Support for hadoop 3 via maven profiles (#11794) Add support for hadoop 3 profiles . Most of the details are captured in #11791 . We use a combination of maven profiles and resource filtering to achieve this. Hadoop2 is supported by default and a new maven profile with the name hadoop3 is created. This will allow the user to choose the profile which is best suited for the use case.
2021-10-30 13:16:24 -04:00
<suppress until="2021-12-30">
<!-- Suppress this until https://github.com/apache/druid/issues/11028 is resolved. -->
<notes><![CDATA[
This vulnerability should be fixed soon and the suppression should be removed.
]]></notes>
<cve>CVE-2020-13949</cve>
</suppress>
suppress (#11002)
2021-03-16 21:17:57 -04:00
<suppress>
<!-- (avro, parquet, integration-tests) we don't allow velocity templates to be uploaded by untrusted users -->
<notes><![CDATA[
file name: velocity-engine-core-2.2.jar:
]]></notes>
<cve>CVE-2020-13936</cve>
</suppress>
Suppress CVEs for Solr and org.codehaus.jackson (#11030) * Suppress CVEs for Solr and org.codehaus.jackson * add a comment
2021-03-24 19:44:05 -04:00
<suppress>
<!-- (ranger, ambari, and aliyun-oss) these vulnerabilities are legit, but their latest releases still use the vulnerable jackson version -->
<notes><![CDATA[
file name: jackson-xc-1.9.x.jar or jackson-jaxrs-1.9.x.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.codehaus\.jackson/jackson-(xc|jaxrs)@1.9.*$</packageUrl>
<cve>CVE-2018-14718</cve>
<cve>CVE-2018-7489</cve>
</suppress>
<suppress>
Suppress CVEs for jdom2, kafka-clients, libthrift, solr-solrj (#11572)
2021-08-11 06:16:57 -04:00
<!-- Transitive dependency from apache-ranger, latest ranger version 2.1.0 still uses solr 7.7.1-->
<notes><![CDATA[
Suppress CVEs for Solr and org.codehaus.jackson (#11030) * Suppress CVEs for Solr and org.codehaus.jackson * add a comment
2021-03-24 19:44:05 -04:00
file name: solr-solrj-7.7.1.jar
]]></notes>
Suppress CVEs for jdom2, kafka-clients, libthrift, solr-solrj (#11572)
2021-08-11 06:16:57 -04:00
<packageUrl regex="true">^pkg:maven/org\.apache\.solr/solr-solrj@7.7.1$</packageUrl>
<cve>CVE-2020-13957</cve>
<cve>CVE-2019-17558</cve>
<cve>CVE-2019-0193</cve>
<cve>CVE-2020-13941</cve>
<cve>CVE-2021-29943</cve>
<cve>CVE-2021-27905</cve>
<cve>CVE-2021-29262</cve>
CVE suppression (#12535)
2022-05-19 01:51:48 -04:00
<cve>CVE-2021-44548</cve>
Suppress CVEs for jdom2, kafka-clients, libthrift, solr-solrj (#11572)
2021-08-11 06:16:57 -04:00
</suppress>
<suppress>
<!-- Transitive dependency from aliyun-sdk-oss, there is currently no newer version of jdom2 as well-->
<notes><![CDATA[
file name: jdom2-2.0.6.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.jdom/jdom2@2.0.6$</packageUrl>
<cve>CVE-2021-33813</cve>
</suppress>
<suppress>
<!-- Upgrading to libthrift-0.14.2 adds many tomcat CVEs, suppress and stay at 0.13.0 for now-->
<notes><![CDATA[
file name: libthrift-0.13.0.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.thrift/libthrift@0.13.0$</packageUrl>
<cve>CVE-2020-13949</cve>
Suppress CVEs for Solr and org.codehaus.jackson (#11030) * Suppress CVEs for Solr and org.codehaus.jackson * add a comment
2021-03-24 19:44:05 -04:00
</suppress>
suppress hive-storage-api thrift security vulnerability (#11753)
2021-09-29 02:54:13 -04:00
<suppress>
Suppress some false alarm CVEs (#12812) This commit suppresses the following CVEs: - CVE-2021-43138: false alarm for async-http-client - CVE-2021-34538: applicable to Hive server - CVE-2020-25638: requires hibernate update, which causes Hadoop ingestion failure - CVE-2021-27568: false alarm for accessors-smart which is a dependency of json-smart (already suppressed)
2022-07-22 12:57:31 -04:00
<!--
1. hive-storage-api has the thrift vulnerability too
2. CVE-2021-34538 pertains to Hive server.
-->
suppress hive-storage-api thrift security vulnerability (#11753)
2021-09-29 02:54:13 -04:00
<notes><![CDATA[
file name: hive-storage-api-2.8.1.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@2.8.1$</packageUrl>
<cve>CVE-2020-13949</cve>
Suppress some false alarm CVEs (#12812) This commit suppresses the following CVEs: - CVE-2021-43138: false alarm for async-http-client - CVE-2021-34538: applicable to Hive server - CVE-2020-25638: requires hibernate update, which causes Hadoop ingestion failure - CVE-2021-27568: false alarm for accessors-smart which is a dependency of json-smart (already suppressed)
2022-07-22 12:57:31 -04:00
<cve>CVE-2021-34538</cve>
suppress hive-storage-api thrift security vulnerability (#11753)
2021-09-29 02:54:13 -04:00
</suppress>
suppress false positive cve (#11699) * suppress false positive cve * update comment, dont run tests on changes to owasp-dependency-check-suppressions.xml
2021-09-13 23:45:38 -04:00
<suppress>
<!--
the scanner misattributes this to Apache DataSketches
the actual vulnerability affects some collaboration tool called Sketch, and impacts some 'library feeds' feature
which seems to relate to how the tool handles sharing designs or something, so we are doing a blanket ignore
because it seems nearly impossible for us to be affected by this
-->
<cve>CVE-2021-40531</cve>
</suppress>
Support for hadoop 3 via maven profiles (#11794) Add support for hadoop 3 profiles . Most of the details are captured in #11791 . We use a combination of maven profiles and resource filtering to achieve this. Hadoop2 is supported by default and a new maven profile with the name hadoop3 is created. This will allow the user to choose the profile which is best suited for the use case.
2021-10-30 13:16:24 -04:00
<suppress>
<!-- These are for wildfly-openssl. -->
<notes><![CDATA[
file name: wildfly-openssl-1.0.7.Final.jar
]]></notes>
<cve>CVE-2020-10740</cve>
<cve>CVE-2020-25644</cve>
<cve>CVE-2020-10718</cve>
</suppress>
<suppress>
<!-- Suppress aws-java-sdk-bundle cves -->
<notes><![CDATA[
file name: aws-java-sdk-bundle-1.11.901.jar
]]></notes>
<cve>CVE-2020-8570</cve>
<cve>CVE-2015-8559</cve>
<cve>CVE-2021-20291</cve>
<cve>CVE-2017-17485</cve>
<cve>CVE-2018-5968</cve>
<cve>CVE-2017-15095</cve>
<cve>CVE-2019-16942</cve>
<cve>CVE-2020-25649</cve>
<cve>CVE-2020-35491</cve>
<cve>CVE-2019-16943</cve>
<cve>CVE-2020-35490</cve>
<cve>CVE-2019-20330</cve>
<cve>CVE-2020-10673</cve>
<cve>CVE-2018-11307</cve>
<cve>CVE-2018-7489</cve>
<cve>CVE-2019-17267</cve>
<cve>CVE-2019-17531</cve>
<cve>CVE-2019-16335</cve>
<cve>CVE-2019-14893</cve>
<cve>CVE-2019-14540</cve>
Add CVEs for Hadoop3 (#12336) * Add CVEs * Move CVEs under hadoop3 section
2022-06-22 04:42:17 -04:00
<cve>CVE-2021-37136</cve>
<cve>CVE-2021-37137</cve>
Support for hadoop 3 via maven profiles (#11794) Add support for hadoop 3 profiles . Most of the details are captured in #11791 . We use a combination of maven profiles and resource filtering to achieve this. Hadoop2 is supported by default and a new maven profile with the name hadoop3 is created. This will allow the user to choose the profile which is best suited for the use case.
2021-10-30 13:16:24 -04:00
</suppress>
<suppress>
<!-- Suppress hadoop-shaded-guava cves -->
<notes><![CDATA[
file name: hadoop-shaded-guava-1.1.1.jar
]]></notes>
<cve>CVE-2015-7430</cve>
<cve>CVE-2017-3162</cve>
</suppress>
Suppress Avro CVEs (#12166)
2022-01-18 10:39:48 -05:00
<suppress>
<!-- Suppress avro cves that are only applicable to .NET SDK-->
<notes><![CDATA[
file name: avro-1.9.2.jar or avro-ipc-jetty-1.9.2.jar
]]></notes>
<cve>CVE-2021-43045</cve>
</suppress>
Suppress CVE-2021-43138 (#12437) * Suppress CVE-2021-43138 * revert netty 3.10.5.Final
2022-04-18 23:00:06 -04:00
<suppress>
<!-- False alarm for the Async javascript library (https://github.com/caolan/async) which is a dev dependency for the web console -->
<notes><![CDATA[
file name: async-http-client-netty-utils-2.5.3.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.asynchttpclient/async-http-client-netty-utils@2.5.3$</packageUrl>
<cve>CVE-2021-43138</cve>
</suppress>
Supress CVE 2022 26612 (#12463) * supress CVE-2022-26612 * adding packageUrl * suppressing CVE-2022-26612 * adding packageUrl * moving to hadoop section
2022-04-21 11:48:20 -04:00
Suppress some false alarm CVEs (#12812) This commit suppresses the following CVEs: - CVE-2021-43138: false alarm for async-http-client - CVE-2021-34538: applicable to Hive server - CVE-2020-25638: requires hibernate update, which causes Hadoop ingestion failure - CVE-2021-27568: false alarm for accessors-smart which is a dependency of json-smart (already suppressed)
2022-07-22 12:57:31 -04:00
<suppress>
<!-- False alarm for the Async javascript library (https://github.com/caolan/async) which is a dev dependency for the web console -->
<notes><![CDATA[
file name: async-http-client-2.5.3.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.asynchttpclient/async-http-client@2.5.3$</packageUrl>
<cve>CVE-2021-43138</cve>
</suppress>
CVE suppression (#12535)
2022-05-19 01:51:48 -04:00
<suppress>
<!-- Jackson CVEs when processing objects of large depth. Consider updating -->
<notes><![CDATA[
file name: *jackson-*.jar
]]></notes>
<cve>CVE-2020-36518</cve>
</suppress>
<suppress>
<!-- Non-applicable CVE for gson -->
<notes><![CDATA[
file name: gson-*.jar
]]></notes>
<cve>CVE-2022-25647</cve>
</suppress>
<suppress>
<!-- Non-applicable CVE for jedis, since we don't use lua scripts -->
<notes><![CDATA[
file name: jedis-2.9.0.jar
]]></notes>
<cve>CVE-2021-32626</cve>
<cve>CVE-2022-24735</cve>
</suppress>
Suppress CVEs (#12553)
2022-05-23 03:05:23 -04:00
<suppress>
<!-- pac4j-core-3.8.3 -->
<notes><![CDATA[
file name: pac4j-core-3.8.3.jar
]]></notes>
<cve>CVE-2021-44878</cve>
</suppress>
Suppress CVEs (#12590)
2022-06-01 11:52:32 -04:00
<suppress>
<!-- cassandra-all-1.0.8.jar -->
<notes><![CDATA[
file name: cassandra-all-1.0.8.jar
]]></notes>
<cve>CVE-2020-17516</cve>
</suppress>
<suppress>
<!-- jackson-dataformat-cbor-2.10.5.jar -->
<notes><![CDATA[
file name: jackson-dataformat-cbor-2.10.5.jar
]]></notes>
<cve>CVE-2020-28491</cve>
</suppress>
<suppress>
<!-- okhttp -->
<notes><![CDATA[
file name: okhttp-*.jar
]]></notes>
<cve>CVE-2021-0341</cve>
</suppress>
<suppress>
<!-- parquet-format-structures-1.12.0.jar -->
<notes><![CDATA[
file name: parquet-format-structures-1.12.0.jar
]]></notes>
<cve>CVE-2021-41561</cve>
</suppress>
Suppress CVEs - Avatica, Postgres (#12884)
2022-08-10 04:48:19 -04:00
<suppress>
<!-- Avatica server itself is not affected. Vulnerability exists only on client. -->
<notes><![CDATA[
file name: avatica-server-1.17.0.jar
]]></notes>
<cve>CVE-2022-36364</cve>
</suppress>
<suppress>
<!-- False positive. 42.3.3 is not affected by the CVE. And we don't use Resultset.refreshRow method either -->
<notes><![CDATA[
file name: postgresql-42.3.3.jar
]]></notes>
<cve>CVE-2022-31197</cve>
</suppress>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
</suppressions>