Apache
/
druid
mirror of https://github.com/apache/druid.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
druid/owasp-dependency-check-supp...

843 lines
34 KiB
XML
Raw Normal View History

Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<?xml version="1.0" encoding="UTF-8"?>
<!--
~ Licensed to the Apache Software Foundation (ASF) under one
~ or more contributor license agreements. See the NOTICE file
~ distributed with this work for additional information
~ regarding copyright ownership. The ASF licenses this file
~ to you under the Apache License, Version 2.0 (the
~ "License"); you may not use this file except in compliance
~ with the License. You may obtain a copy of the License at
~
~ http://www.apache.org/licenses/LICENSE-2.0
~
~ Unless required by applicable law or agreed to in writing,
~ software distributed under the License is distributed on an
~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
~ KIND, either express or implied. See the License for the
~ specific language governing permissions and limitations
~ under the License.
-->
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
<suppress>
<!-- druid-indexing-hadoop.jar is mistaken for hadoop -->
<notes><![CDATA[
Remove druid incubating references (#9405)
2020-02-27 00:47:58 -05:00
file name: org.apache.druid:druid-indexing-hadoop
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.druid/druid\-indexing\-hadoop@.*$</packageUrl>
<cve>CVE-2012-4449</cve>
<cve>CVE-2017-3162</cve>
suppress false positive cve (#11699) * suppress false positive cve * update comment, dont run tests on changes to owasp-dependency-check-suppressions.xml
2021-09-13 23:45:38 -04:00
<cve>CVE-2018-8009</cve>
Suppress false CVE on druid-indexing-hadoop artifact (#12562)
2022-05-24 06:30:58 -04:00
<cve>CVE-2022-26612</cve>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
</suppress>
<suppress>
<!-- druid-processing.jar is mistaken for org.processing:processing -->
<notes><![CDATA[
Remove druid incubating references (#9405)
2020-02-27 00:47:58 -05:00
file name: org.apache.druid:druid-processing
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.druid/druid\-processing@.*$</packageUrl>
<cve>CVE-2018-1000840</cve>
</suppress>
<suppress>
<!-- These CVEs are for the python SDK, but Druid uses the Java SDK -->
<notes><![CDATA[
Suppress CVEs for htrace-core4 and openstack-swift (#9489) CVE-2013-7109 can be ignored for openstack-swift as it is for the python SDK and druid uses the java SDK. The jackson-databind:2.4.0 CVEs via htrace-core4 are all suppressed for now as fixing them requires updating the hadoop version.
2020-03-10 13:55:41 -04:00
file name: openstack-swift
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.jclouds\.api/openstack\-swift@.*$</packageUrl>
Suppress CVEs for htrace-core4 and openstack-swift (#9489) CVE-2013-7109 can be ignored for openstack-swift as it is for the python SDK and druid uses the java SDK. The jackson-databind:2.4.0 CVEs via htrace-core4 are all suppressed for now as fixing them requires updating the hadoop version.
2020-03-10 13:55:41 -04:00
<cve>CVE-2013-7109</cve>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<cve>CVE-2016-0737</cve>
<cve>CVE-2016-0738</cve>
<cve>CVE-2017-16613</cve>
</suppress>
<suppress>
<notes><![CDATA[
Suppress false CVEs (#13026) * Suppress CVEs * Add more suppressions
2022-09-06 02:16:56 -04:00
file name: openstack-keystone-1.9.1.jar
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.jclouds\.api/openstack\-keystone@.*$</packageUrl>
Suppress false CVEs (#13026) * Suppress CVEs * Add more suppressions
2022-09-06 02:16:56 -04:00
<!-- These CVEs are for the python SDK, but Druid uses the Java SDK -->
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<cve>CVE-2015-7546</cve>
Suppress CVEs for openstack-keystone (#9903) CVE-2020-12689, CVE-2020-12691, and CVE-2020-12690 can be ignored for openstack-keystone as they are for the python SDK and druid uses the java SDK.
2020-05-22 13:32:17 -04:00
<cve>CVE-2020-12689</cve>
<cve>CVE-2020-12690</cve>
<cve>CVE-2020-12691</cve>
Suppress false CVEs (#13026) * Suppress CVEs * Add more suppressions
2022-09-06 02:16:56 -04:00
<!-- This CVE affects the server -->
<cve>CVE-2021-3563</cve>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
</suppress>
Fixing security vulnerability check errors (#13956) * Fixing security vulnerability check errors * Updating javax.el to jakarta.el * Adding cron job trigger on changes to suppressions file
2023-03-23 01:40:06 -04:00
<suppress>
<notes><![CDATA[
file name: json-path-2.3.0.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/net\.minidev/json\-path@.*$</packageUrl>
<cve>CVE-2022-45688</cve>
Suppress CVE-2021-27568 from json-smart 2.3 dependency (#11438) Dependency on hadoop 2.8.5 is preventing us form updating this dependency to a later version. We don't believe that this is a major concern since Druid eats uncaught exceptions, and only displays them in logs. This issue also should only affect ingestion jobs, which can only be run by admin type users.
2021-07-12 22:58:06 -04:00
</suppress>
Fixing security vulnerability check errors (#13956) * Fixing security vulnerability check errors * Updating javax.el to jakarta.el * Adding cron job trigger on changes to suppressions file
2023-03-23 01:40:06 -04:00
Port CVE suppressions from 24.0.1 (#13415) * Suppress jackson-databind CVE-2022-42003 and CVE-2022-42004 (cherry picked from commit 1f4d892c9a2dbc3ce6df1481fd4c6d242ba0ea8d) * Suppress CVEs (cherry picked from commit ed55baa8fa7d7f914a0addabb072d9ed47e1cd9f) * Suppress vulnerabilities from druid-website package (cherry picked from commit c0fb364f8049d53cd704e414e2ffeab6c49b012e) * Add more suppressions for website package (cherry picked from commit 9bba569ebd52c5480bf4219c420ed78eb053701f)
2022-11-23 01:05:33 -05:00
<suppress>
<!--
suppress hadoop3 cve that seem not applicable to us (#14252)
2023-05-11 02:08:05 -04:00
the suppressions here aren't currently applicable, but can be resolved once we update the version
Port CVE suppressions from 24.0.1 (#13415) * Suppress jackson-databind CVE-2022-42003 and CVE-2022-42004 (cherry picked from commit 1f4d892c9a2dbc3ce6df1481fd4c6d242ba0ea8d) * Suppress CVEs (cherry picked from commit ed55baa8fa7d7f914a0addabb072d9ed47e1cd9f) * Suppress vulnerabilities from druid-website package (cherry picked from commit c0fb364f8049d53cd704e414e2ffeab6c49b012e) * Add more suppressions for website package (cherry picked from commit 9bba569ebd52c5480bf4219c420ed78eb053701f)
2022-11-23 01:05:33 -05:00
-->
<notes><![CDATA[
file name: jackson-databind-2.10.5.1.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$</packageUrl>
suppress hadoop3 cve that seem not applicable to us (#14252)
2023-05-11 02:08:05 -04:00
<!-- CVE-2022-42003 and CVE-2022-42004 are related to UNWRAP_SINGLE_VALUE_ARRAYS which we do not use
https://nvd.nist.gov/vuln/detail/CVE-2022-42003
https://nvd.nist.gov/vuln/detail/CVE-2022-42004
-->
Port CVE suppressions from 24.0.1 (#13415) * Suppress jackson-databind CVE-2022-42003 and CVE-2022-42004 (cherry picked from commit 1f4d892c9a2dbc3ce6df1481fd4c6d242ba0ea8d) * Suppress CVEs (cherry picked from commit ed55baa8fa7d7f914a0addabb072d9ed47e1cd9f) * Suppress vulnerabilities from druid-website package (cherry picked from commit c0fb364f8049d53cd704e414e2ffeab6c49b012e) * Add more suppressions for website package (cherry picked from commit 9bba569ebd52c5480bf4219c420ed78eb053701f)
2022-11-23 01:05:33 -05:00
<cve>CVE-2022-42003</cve>
<cve>CVE-2022-42004</cve>
</suppress>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
Address CVE-2020-8570, suppress CVE-2020-8554 (#10826) * Address CVE-2020-8570, suppress CVE-2020-8554 * Update licenses.yaml
2021-02-03 18:17:06 -05:00
<suppress>
<!-- Not much for us to do as a user of the client lib, and no patch is available,
see https://github.com/kubernetes/kubernetes/issues/97076 -->
<notes><![CDATA[
file name: client-java-10.0.1.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/io\.kubernetes/client\-java.*@10.0.1$</packageUrl>
<cve>CVE-2020-8554</cve>
</suppress>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<!-- FIXME: These are suppressed so that CI can enforce that no new vulnerable dependencies are added. -->
<suppress>
<!--
~ TODO: Fix by updating hibernate-validator.
~ Note hibernate-validator:5.3.1 introduces a change that requires an EL implementation to be in the classpath:
~ https://developer.jboss.org/wiki/HibernateValidatorMigrationGuide#jive_content_id_531Final
~
~ For example, updating hibernate-validator causes hadoop ingestion tasks to fail:
~
~ Error: com.google.inject.CreationException: Unable to create injector, see the following errors:
~
~ 1) An exception was caught and reported. Message: HV000183: Unable to initialize 'javax.el.ExpressionFactory'. Check that you have the EL dependencies on the classpath, or use ParameterMessageInterpolator instead
~ at com.google.inject.internal.InjectorShell$Builder.build(InjectorShell.java:138)
~
~ 2) No implementation for javax.validation.Validator was bound.
~ at org.apache.druid.guice.ConfigModule.configure(ConfigModule.java:39)
~
~ 2 errors
~ at com.google.inject.internal.Errors.throwCreationExceptionIfErrorsExist(Errors.java:470)
~ at com.google.inject.internal.InternalInjectorCreator.initializeStatically(InternalInjectorCreator.java:155)
~ at com.google.inject.internal.InternalInjectorCreator.build(InternalInjectorCreator.java:107)
~ at com.google.inject.Guice.createInjector(Guice.java:99)
~ at com.google.inject.Guice.createInjector(Guice.java:73)
~ at org.apache.druid.guice.GuiceInjectors.makeStartupInjector(GuiceInjectors.java:56)
~ at org.apache.druid.indexer.HadoopDruidIndexerConfig.<clinit>(HadoopDruidIndexerConfig.java:102)
~ at org.apache.druid.indexer.HadoopDruidIndexerMapper.setup(HadoopDruidIndexerMapper.java:53)
~ at org.apache.druid.indexer.DetermineHashedPartitionsJob$DetermineCardinalityMapper.setup(DetermineHashedPartitionsJob.java:279)
~ at org.apache.druid.indexer.DetermineHashedPartitionsJob$DetermineCardinalityMapper.run(DetermineHashedPartitionsJob.java:334)
~ at org.apache.hadoop.mapred.MapTask.runNewMapper(MapTask.java:787)
~ at org.apache.hadoop.mapred.MapTask.run(MapTask.java:341)
~ at org.apache.hadoop.mapred.YarnChild$2.run(YarnChild.java:175)
~ at java.security.AccessController.doPrivileged(Native Method)
~ at javax.security.auth.Subject.doAs(Subject.java:422)
~ at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1844)
~ at org.apache.hadoop.mapred.YarnChild.main(YarnChild.java:169)
~ Caused by: javax.validation.ValidationException: HV000183: Unable to initialize 'javax.el.ExpressionFactory'. Check that you have the EL dependencies on the classpath, or use ParameterMessageInterpolator instead
~ at org.hibernate.validator.messageinterpolation.ResourceBundleMessageInterpolator.buildExpressionFactory(ResourceBundleMessageInterpolator.java:102)
~ at org.hibernate.validator.messageinterpolation.ResourceBundleMessageInterpolator.<init>(ResourceBundleMessageInterpolator.java:45)
~ at org.hibernate.validator.internal.engine.ConfigurationImpl.getDefaultMessageInterpolator(ConfigurationImpl.java:423)
~ at org.hibernate.validator.internal.engine.ConfigurationImpl.getDefaultMessageInterpolatorConfiguredWithClassLoader(ConfigurationImpl.java:575)
~ at org.hibernate.validator.internal.engine.ConfigurationImpl.getMessageInterpolator(ConfigurationImpl.java:364)
~ at org.hibernate.validator.internal.engine.ValidatorFactoryImpl.<init>(ValidatorFactoryImpl.java:148)
~ at org.hibernate.validator.HibernateValidator.buildValidatorFactory(HibernateValidator.java:38)
~ at org.hibernate.validator.internal.engine.ConfigurationImpl.buildValidatorFactory(ConfigurationImpl.java:331)
~ at javax.validation.Validation.buildDefaultValidatorFactory(Validation.java:110)
~ at org.apache.druid.guice.ConfigModule.configure(ConfigModule.java:39)
~ at com.google.inject.spi.Elements$RecordingBinder.install(Elements.java:340)
~ at com.google.inject.spi.Elements.getElements(Elements.java:110)
~ at com.google.inject.internal.InjectorShell$Builder.build(InjectorShell.java:138)
~ at com.google.inject.internal.InternalInjectorCreator.build(InternalInjectorCreator.java:104)
~ ... 14 more
~ Caused by: java.lang.NoSuchMethodError: javax.el.ExpressionFactory.newInstance()Ljavax/el/ExpressionFactory;
~ at org.hibernate.validator.messageinterpolation.ResourceBundleMessageInterpolator.buildExpressionFactory(ResourceBundleMessageInterpolator.java:98)
~ ... 27 more
-->
<notes><![CDATA[
Suppress CVEs (#14291) Address various CVEs by upgrading dependencies or adding suppression with a justification
2023-07-10 05:49:26 -04:00
file name: hibernate-validator-5.3.6.Final.jar
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
file name: hibernate-validator-5.2.5.Final.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.hibernate/hibernate\-validator@.*$</packageUrl>
<cve>CVE-2017-7536</cve>
Suppress CVEs (#14291) Address various CVEs by upgrading dependencies or adding suppression with a justification
2023-07-10 05:49:26 -04:00
<cve>CVE-2019-10219</cve> <!-- We don't use SafeHtml validator annotation https://nvd.nist.gov/vuln/detail/CVE-2019-10219 -->
<cve>CVE-2019-14900</cve> <!-- Not applicable to hibernate validator https://github.com/hibernate/hibernate-orm/pull/3438 -->
<cve>CVE-2020-10693</cve> <!-- We don't take user input in constraint violation message https://hibernate.atlassian.net/browse/HV-1774 -->
Suppress some false alarm CVEs (#12812) This commit suppresses the following CVEs: - CVE-2021-43138: false alarm for async-http-client - CVE-2021-34538: applicable to Hive server - CVE-2020-25638: requires hibernate update, which causes Hadoop ingestion failure - CVE-2021-27568: false alarm for accessors-smart which is a dependency of json-smart (already suppressed)
2022-07-22 12:57:31 -04:00
<cve>CVE-2020-25638</cve>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
</suppress>
<suppress>
<!-- TODO: Fix by updating curator-x-discovery to > 4.2.0 and updating hadoop -->
<notes><![CDATA[
file name: jackson-mapper-asl-1.9.13.jar
]]></notes>
Suppress CVEs for jackson-mapper-asl:1.9.13 (#9604) The jackson-mapper-asl:1.9.13 CVEs via curator-x-discovery are all suppressed for now as fixing them requires updating the curator version.
2020-04-03 13:33:52 -04:00
<packageUrl regex="true">^pkg:maven/org\.codehaus\.jackson/jackson\-mapper\-asl@1.9.13$</packageUrl>
<cvssBelow>10</cvssBelow> <!-- suppress all CVEs for jackson-mapper-asl:1.9.13 ince it is via curator-x-discovery -->
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
</suppress>
<suppress>
<!-- TODO: Fix by updating org.apache.druid.java.util.http.client.NettyHttpClient to use netty 4 -->
<notes><![CDATA[
file name: netty-3.10.6.Final.jar
]]></notes>
Suppress CVEs for htrace-core4 and openstack-swift (#9489) CVE-2013-7109 can be ignored for openstack-swift as it is for the python SDK and druid uses the java SDK. The jackson-databind:2.4.0 CVEs via htrace-core4 are all suppressed for now as fixing them requires updating the hadoop version.
2020-03-10 13:55:41 -04:00
<packageUrl regex="true">^pkg:maven/io\.netty/netty@3.10.6.Final$</packageUrl>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<cve>CVE-2019-16869</cve>
Fix / suppress netty CVEs CVE-2019-20445 and CVE-2019-20444 (#9300) * Suppress netty 3 vulnerabilites and upgrade netty 4 version * Upgrade netty 4 version to fix vulnerabilities CVE-2019-20445 and CVE-2019-20444 * suppress these CVEs for netty 3 * * simplify suppression xml file * update licenses file with new version of netty * * fix type in licenses.yaml
2020-01-31 17:51:54 -05:00
<cve>CVE-2019-20444</cve>
<cve>CVE-2019-20445</cve>
Fixing security vulnerability check errors (#13956) * Fixing security vulnerability check errors * Updating javax.el to jakarta.el * Adding cron job trigger on changes to suppressions file
2023-03-23 01:40:06 -04:00
<cve>CVE-2020-11612</cve>
Suppress CVEs (#14291) Address various CVEs by upgrading dependencies or adding suppression with a justification
2023-07-10 05:49:26 -04:00
<cve>CVE-2021-21290</cve> <!-- We don't use HttpPostRequestDecoder or HttpPostMultiPartRequestDecoder which uses vulnerable AbstractDiskHttpData - https://github.com/advisories/GHSA-5mcr-gq6c-3hq2 -->
<cve>CVE-2021-21295</cve> <!-- We don't use HTTP2MultiplexCodec or Http2FrameCodec or Http2StreamFrameToHttpObjectCodec affected or convert HTTP/2 to HTTP/1.1 requests - https://github.com/advisories/GHSA-wm47-8v5p-wjpj -->
<cve>CVE-2021-21409</cve> <!-- We don't use Http2HeaderFrame or convert HTTP/2 to HTTP/1.1 requests https://github.com/advisories/GHSA-f256-j965-7f32 -->
Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 (#11844) * bump netty4 to 4.1.68 * suppress CVE-2021-37136 and CVE-2021-37137 for netty3 * license
2021-10-26 00:09:15 -04:00
<cve>CVE-2021-37136</cve>
<cve>CVE-2021-37137</cve>
Suppress CVEs (#14291) Address various CVEs by upgrading dependencies or adding suppression with a justification
2023-07-10 05:49:26 -04:00
<cve>CVE-2021-43797</cve> <!-- We don't decode user HTTP requests nor forward them to remote systems, we also don't support for java 6 or lower - https://github.com/advisories/GHSA-wx5j-54mm-rqqq -->
<cve>CVE-2022-24823</cve> <!-- We don't decode user HTTP requests nor forward them to remote systems, we also don't support for java 6 or lower - https://github.com/advisories/GHSA-269q-hmxg-m83q -->
Upgrade to netty 4.1.86.Final to address CVEs (#13604) This commit addresses the following CVEs: - CVE-2021-43797 - CVE-2022-41881
2022-12-22 15:14:01 -05:00
<cve>CVE-2022-41881</cve>
Suppress CVEs (#14648) CVE-2023-34462 - (Allows malicious allocation of resources without throttling) Not applicable as the Netty requests in Druid are internal, and not user facing. CVE-2016-2402 - (Man in the middle with okhttp by sending certificate chains) Not applicable as okhttp requests in Druid are also internal
2023-07-25 04:07:50 -04:00
<cve>CVE-2023-34462</cve> <!-- Suppressed since netty requests in Druid are internal, and not user-facing -->
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
</suppress>
<suppress>
<!-- TODO: Fix by upgrading hadoop-auth version -->
<notes><![CDATA[
file name: nimbus-jose-jwt-4.41.1.jar
]]></notes>
Suppress CVEs for htrace-core4 and openstack-swift (#9489) CVE-2013-7109 can be ignored for openstack-swift as it is for the python SDK and druid uses the java SDK. The jackson-databind:2.4.0 CVEs via htrace-core4 are all suppressed for now as fixing them requires updating the hadoop version.
2020-03-10 13:55:41 -04:00
<packageUrl regex="true">^pkg:maven/com\.nimbusds/nimbus\-jose\-jwt@4.41.1$</packageUrl>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<cve>CVE-2019-17195</cve>
</suppress>
Suppressing false positive CVE-2020-7791 (#11215) * suppressing false positive CVE-2020-7791 * add comments
2021-05-06 18:24:12 -04:00
<suppress>
<!-- This CVE is a false positive. The CVE is not for apacheds-i18n -->
<notes><![CDATA[
file name: apacheds-i18n-2.0.0-M15.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.directory\.server/apacheds\-i18n@.*$</packageUrl>
<cve>CVE-2020-7791</cve>
</suppress>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<suppress>
Ignore CVEs from htrace and ambari transitive deps (#10353) * Ignore CVEs from htrace and ambari transitive deps htrace CVEs are suppressed for now as addressing them requires updating the hadoop version. ambari CVEs are suppressed for now since ambari is updated to the latest version and is no longer actively maintained. * Fix compilation issue from ambari upgrade * Add missing test coverage
2020-09-04 18:22:26 -04:00
<!-- TODO: Fix by using com.datastax.oss:java-driver-core instead of com.netflix.astyanax:astyanax in extensions-contrib/cassandra-storage -->
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<notes><![CDATA[
file name: libthrift-0.6.1.jar
]]></notes>
Suppress CVEs for htrace-core4 and openstack-swift (#9489) CVE-2013-7109 can be ignored for openstack-swift as it is for the python SDK and druid uses the java SDK. The jackson-databind:2.4.0 CVEs via htrace-core4 are all suppressed for now as fixing them requires updating the hadoop version.
2020-03-10 13:55:41 -04:00
<packageUrl regex="true">^pkg:maven/org\.apache\.thrift/libthrift@0.6.1$</packageUrl>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<cve>CVE-2016-5397</cve>
<cve>CVE-2018-1320</cve>
<cve>CVE-2019-0205</cve>
</suppress>
Port CVE suppressions from 24.0.1 (#13415) * Suppress jackson-databind CVE-2022-42003 and CVE-2022-42004 (cherry picked from commit 1f4d892c9a2dbc3ce6df1481fd4c6d242ba0ea8d) * Suppress CVEs (cherry picked from commit ed55baa8fa7d7f914a0addabb072d9ed47e1cd9f) * Suppress vulnerabilities from druid-website package (cherry picked from commit c0fb364f8049d53cd704e414e2ffeab6c49b012e) * Add more suppressions for website package (cherry picked from commit 9bba569ebd52c5480bf4219c420ed78eb053701f)
2022-11-23 01:05:33 -05:00
<suppress>
<!-- TODO: Fix by using com.datastax.oss:java-driver-core instead of com.netflix.astyanax:astyanax in extensions-contrib/cassandra-storage -->
<notes><![CDATA[
file name: jettison-1.*.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.codehaus\.jettison/jettison@1.*$</packageUrl>
<cve>CVE-2022-40149</cve>
<cve>CVE-2022-40150</cve>
Suppress CVE-2022-45685 and CVE-2022-45693 from jettison-1.3 (#13585)
2022-12-16 12:26:30 -05:00
<cve>CVE-2022-45685</cve>
<cve>CVE-2022-45693</cve>
suppress some cves and fix javadoc build when using java 17 (#14241)
2023-05-10 18:47:10 -04:00
<cve>CVE-2023-1436</cve>
Port CVE suppressions from 24.0.1 (#13415) * Suppress jackson-databind CVE-2022-42003 and CVE-2022-42004 (cherry picked from commit 1f4d892c9a2dbc3ce6df1481fd4c6d242ba0ea8d) * Suppress CVEs (cherry picked from commit ed55baa8fa7d7f914a0addabb072d9ed47e1cd9f) * Suppress vulnerabilities from druid-website package (cherry picked from commit c0fb364f8049d53cd704e414e2ffeab6c49b012e) * Add more suppressions for website package (cherry picked from commit 9bba569ebd52c5480bf4219c420ed78eb053701f)
2022-11-23 01:05:33 -05:00
</suppress>
Suppress false CVEs (#13026) * Suppress CVEs * Add more suppressions
2022-09-06 02:16:56 -04:00
<suppress>
<!-- We need to wait for 17.0.0 of https://github.com/kubernetes-client/java/releases -->
CVE fixes - update of multiple dependencies. (#14519) Apache Druid brings multiple direct and transitive dependencies that are affected by plethora of CVEs. This PR attempts to update all the dependencies that did not require code refactoring. This PR modifies pom files, license file and OWASP Dependency Check suppression file.
2023-07-07 10:57:30 -04:00
<!-- We need to update several other components to move to Snakeyaml 2.0 to address CVE-2022-1471 -->
<!-- Snakeyaml 1.33 added to dependencyManagement in main pom file -->
Suppress false CVEs (#13026) * Suppress CVEs * Add more suppressions
2022-09-06 02:16:56 -04:00
<notes><![CDATA[
CVE fixes - update of multiple dependencies. (#14519) Apache Druid brings multiple direct and transitive dependencies that are affected by plethora of CVEs. This PR attempts to update all the dependencies that did not require code refactoring. This PR modifies pom files, license file and OWASP Dependency Check suppression file.
2023-07-07 10:57:30 -04:00
file name: snakeyaml-1.33.jar
Suppress false CVEs (#13026) * Suppress CVEs * Add more suppressions
2022-09-06 02:16:56 -04:00
]]></notes>
Suppress CVE-2022-1471 from snakeyaml (#13557) * Upgrade kube client to 17.0.0 * Remove snakeyaml CVE suppression * Update licenses.yaml * Revert changes and suppress cve
2022-12-15 11:09:14 -05:00
<cve>CVE-2022-1471</cve>
suppress some cves and fix javadoc build when using java 17 (#14241)
2023-05-10 18:47:10 -04:00
<!-- false positive -->
<cve>CVE-2023-2251</cve>
<cve>CVE-2022-3064</cve>
Ignore CVEs from htrace and ambari transitive deps (#10353) * Ignore CVEs from htrace and ambari transitive deps htrace CVEs are suppressed for now as addressing them requires updating the hadoop version. ambari CVEs are suppressed for now since ambari is updated to the latest version and is no longer actively maintained. * Fix compilation issue from ambari upgrade * Add missing test coverage
2020-09-04 18:22:26 -04:00
</suppress>
<suppress>
<notes><![CDATA[
file name: htrace-core4-4.0.1-incubating.jar (shaded: com.fasterxml.jackson.core:jackson-annotations:2.4.0)
]]></notes>
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-annotations@2.4.0$</packageUrl>
<cvssBelow>10</cvssBelow> <!-- suppress all CVEs for jackson-annotations:2.4.0 since it is via htrace-core4 -->
</suppress>
<suppress>
<notes><![CDATA[
file name: htrace-core4-4.0.1-incubating.jar (shaded: com.fasterxml.jackson.core:jackson-core:2.4.0)
]]></notes>
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-core@2.4.0$</packageUrl>
<cvssBelow>10</cvssBelow> <!-- suppress all CVEs for jackson-core:2.4.0 since it is via htrace-core4 -->
</suppress>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
<suppress>
<!--
~ TODO: Fix by updating hadoop-common used by extensions-core/parquet-extensions. Possibly need to change
~ HdfsStorageDruidModule.configure()->FileSystem.get(conf) as well.
-->
<notes><![CDATA[
file name: htrace-core4-4.0.1-incubating.jar (shaded: com.fasterxml.jackson.core:jackson-databind:2.4.0)
]]></notes>
Suppress CVEs for htrace-core4 and openstack-swift (#9489) CVE-2013-7109 can be ignored for openstack-swift as it is for the python SDK and druid uses the java SDK. The jackson-databind:2.4.0 CVEs via htrace-core4 are all suppressed for now as fixing them requires updating the hadoop version.
2020-03-10 13:55:41 -04:00
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@2.4.0$</packageUrl>
<cve>CVE-2018-14721</cve> <!-- cvss of 10.0 -->
<cvssBelow>10</cvssBelow> <!-- suppress all CVEs for jackson-databind:2.4.0 since it is via htrace-core4 -->
</suppress>
<suppress>
<!--
~ TODO: Fix by updating parquet version in extensions-core/parquet-extensions.
-->
<notes><![CDATA[
Ignore CVEs from htrace and ambari transitive deps (#10353) * Ignore CVEs from htrace and ambari transitive deps htrace CVEs are suppressed for now as addressing them requires updating the hadoop version. ambari CVEs are suppressed for now since ambari is updated to the latest version and is no longer actively maintained. * Fix compilation issue from ambari upgrade * Add missing test coverage
2020-09-04 18:22:26 -04:00
file name: parquet-jackson-1.11.0.jar (shaded: com.fasterxml.jackson.core:jackson-{core,databind}:2.9.10)
Suppress CVEs for htrace-core4 and openstack-swift (#9489) CVE-2013-7109 can be ignored for openstack-swift as it is for the python SDK and druid uses the java SDK. The jackson-databind:2.4.0 CVEs via htrace-core4 are all suppressed for now as fixing them requires updating the hadoop version.
2020-03-10 13:55:41 -04:00
]]></notes>
Ignore CVEs from htrace and ambari transitive deps (#10353) * Ignore CVEs from htrace and ambari transitive deps htrace CVEs are suppressed for now as addressing them requires updating the hadoop version. ambari CVEs are suppressed for now since ambari is updated to the latest version and is no longer actively maintained. * Fix compilation issue from ambari upgrade * Add missing test coverage
2020-09-04 18:22:26 -04:00
<packageUrl regex="true">^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-.*@2.9.10$</packageUrl>
<cvssBelow>10</cvssBelow> <!-- suppress all CVEs for jackson-{core,databind}:2.9.0 since it is via parquet transitive dependencies -->
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
</suppress>
Suppress CWE-400 for node-sass:4.13.1 (#9517) The vulnerability is fixed in 4.13.1: https://github.com/sass/node-sass/issues/2816#issuecomment-575136455 But the dependency check plugin thinks its still broken as the affected/fixed versions has not been updated yet on Sonatype OSS Index: https://ossindex.sonatype.org/vuln/c97f4ae7-be1f-4f71-b238-7c095b126e74
2020-03-16 12:42:33 -04:00
<suppress>
<notes><![CDATA[
file name: node-sass:4.13.1
The vulnerability is fixed in 4.13.1: https://github.com/sass/node-sass/issues/2816#issuecomment-575136455
But the dependency check plugin thinks it's still broken as the affected/fixed versions has not been updated on
Sonatype OSS Index: https://ossindex.sonatype.org/vuln/c97f4ae7-be1f-4f71-b238-7c095b126e74
]]></notes>
<packageUrl regex="true">^pkg:npm/node\-sass@.*$</packageUrl>
<vulnerabilityName>CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')</vulnerabilityName>
</suppress>
Document possible vulnerabilities for the druid-ranger-security (#9649) * Document possible vulnerabilities for the druid-ranger-security In certain configurations the ranger plugin can expose vulnerabilities due to some of its dependencies having CVEs. * Spelling checker is a bit tight
2020-04-09 13:43:11 -04:00
<suppress>
<!--
~ TODO: Fix when Apache Ranger 2.1 is released
-->
<notes><![CDATA[
file name: kafka_2.11-2.0.0.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.kafka/kafka_2.11@2.0.0$</packageUrl>
<cve>CVE-2019-12399</cve>
<cve>CVE-2018-17196</cve>
</suppress>
Suppress CVEs for jdom2, kafka-clients, libthrift, solr-solrj (#11572)
2021-08-11 06:16:57 -04:00
<suppress>
<!--
~ TODO: Fix when Apache Ranger 2.1 is released
- transitive dep from apache-ranger, upgrading to 2.1.0 adds other CVEs, staying at ranger 2.0.0 for now
-->
<notes><![CDATA[
file name: kafka-clients-2.0.0.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.kafka/kafka-clients@2.0.0$</packageUrl>
<cve>CVE-2019-12399</cve>
<cve>CVE-2018-17196</cve>
suppress some cves and fix javadoc build when using java 17 (#14241)
2023-05-10 18:47:10 -04:00
<cve>CVE-2023-25194</cve>
Suppress CVEs for jdom2, kafka-clients, libthrift, solr-solrj (#11572)
2021-08-11 06:16:57 -04:00
</suppress>
Port CVE suppressions from 24.0.1 (#13415) * Suppress jackson-databind CVE-2022-42003 and CVE-2022-42004 (cherry picked from commit 1f4d892c9a2dbc3ce6df1481fd4c6d242ba0ea8d) * Suppress CVEs (cherry picked from commit ed55baa8fa7d7f914a0addabb072d9ed47e1cd9f) * Suppress vulnerabilities from druid-website package (cherry picked from commit c0fb364f8049d53cd704e414e2ffeab6c49b012e) * Add more suppressions for website package (cherry picked from commit 9bba569ebd52c5480bf4219c420ed78eb053701f)
2022-11-23 01:05:33 -05:00
<suppress>
<notes><![CDATA[
file name: kafka-clients-3.2.0.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.kafka/kafka\-clients@.*$</packageUrl>
<cve>CVE-2022-34917</cve>
</suppress>
Document possible vulnerabilities for the druid-ranger-security (#9649) * Document possible vulnerabilities for the druid-ranger-security In certain configurations the ranger plugin can expose vulnerabilities due to some of its dependencies having CVEs. * Spelling checker is a bit tight
2020-04-09 13:43:11 -04:00
<suppress>
<!--
suppress some cves and fix javadoc build when using java 17 (#14241)
2023-05-10 18:47:10 -04:00
~ ambari-metrics-emitter, druid-ranger-security
Document possible vulnerabilities for the druid-ranger-security (#9649) * Document possible vulnerabilities for the druid-ranger-security In certain configurations the ranger plugin can expose vulnerabilities due to some of its dependencies having CVEs. * Spelling checker is a bit tight
2020-04-09 13:43:11 -04:00
-->
<notes><![CDATA[
file name: log4j-1.2.17.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/log4j/log4j@1.2.17$</packageUrl>
<cve>CVE-2019-17571</cve>
Suppress CVEs (#12553)
2022-05-23 03:05:23 -04:00
<cve>CVE-2021-4104</cve>
<cve>CVE-2020-9493</cve>
<cve>CVE-2022-23307</cve>
<cve>CVE-2022-23305</cve>
<cve>CVE-2022-23302</cve>
suppress some cves and fix javadoc build when using java 17 (#14241)
2023-05-10 18:47:10 -04:00
<cve>CVE-2023-26464</cve>
Document possible vulnerabilities for the druid-ranger-security (#9649) * Document possible vulnerabilities for the druid-ranger-security In certain configurations the ranger plugin can expose vulnerabilities due to some of its dependencies having CVEs. * Spelling checker is a bit tight
2020-04-09 13:43:11 -04:00
</suppress>
Suppress CVE-2022-33915 (#12740)
2022-07-04 13:18:08 -04:00
<suppress>
<notes><![CDATA[
file name: log4j-core-2.17.1.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1$</packageUrl>
<cve>CVE-2022-33915</cve>
</suppress>
Suppress ambari metrics CVEs (#14645) * Suppress ambari metrics CVEs
2023-07-24 08:31:56 -04:00
<suppress>
<notes><![CDATA[
file name: ambari-metrics-common-2.7.0.0.0.jar
]]></notes>
<cve>CVE-2022-45855</cve>
<cve>CVE-2022-42009</cve>
Fix reported CVEs (#14882) Suppress CVEs from dependencies with no available fix or false positives hadoop-annotations: CVE-2022-25168, CVE-2021-33036 hadoop-client-runtime: CVE-2023-1370, CVE-2023-37475 okio: CVE-2023-3635 Upgrade grpc version to fix CVE-2023-33953
2023-08-24 09:58:55 -04:00
<!-- Suppress hadoop CVEs that not applicable to hadoop-annotations -->
<cve>CVE-2022-25168</cve> <!-- Affected FileUtil.unTar(File, File) API isn't present in hadoop-annotations -->
<cve>CVE-2021-33036</cve> <!-- Only applicable to hadoop-yarn-server -->
Suppress ambari metrics CVEs (#14645) * Suppress ambari metrics CVEs
2023-07-24 08:31:56 -04:00
</suppress>
Ignore CVEs from htrace and ambari transitive deps (#10353) * Ignore CVEs from htrace and ambari transitive deps htrace CVEs are suppressed for now as addressing them requires updating the hadoop version. ambari CVEs are suppressed for now since ambari is updated to the latest version and is no longer actively maintained. * Fix compilation issue from ambari upgrade * Add missing test coverage
2020-09-04 18:22:26 -04:00
<suppress>
Bump netty4 to 4.1.68; suppress CVE-2021-37136 and CVE-2021-37137 for netty3 (#11844) * bump netty4 to 4.1.68 * suppress CVE-2021-37136 and CVE-2021-37137 for netty3 * license
2021-10-26 00:09:15 -04:00
<!--
- TODO: The lastest version of ambari-metrics-common is 2.7.0.0.0, released in July 2018.
-->
<notes><![CDATA[
file name: ambari-metrics-common-2.7.0.0.0.jar (shaded: io.netty:netty:3.10.5.Final)
]]></notes>
<packageUrl regex="true">^pkg:maven/io\.netty/netty@3.10.5.Final$</packageUrl>
<cve>CVE-2019-16869</cve>
<cve>CVE-2019-20444</cve>
<cve>CVE-2019-20445</cve>
<cve>CVE-2021-37136</cve>
<cve>CVE-2021-37137</cve>
CVE suppression (#12535)
2022-05-19 01:51:48 -04:00
<cve>CVE-2021-4104</cve>
<cve>CVE-2020-9493</cve>
<cve>CVE-2022-23307</cve>
<cve>CVE-2022-23305</cve>
<cve>CVE-2022-23302</cve>
Upgrade to netty 4.1.86.Final to address CVEs (#13604) This commit addresses the following CVEs: - CVE-2021-43797 - CVE-2022-41881
2022-12-22 15:14:01 -05:00
<cve>CVE-2022-41881</cve>
suppress some cves and fix javadoc build when using java 17 (#14241)
2023-05-10 18:47:10 -04:00
<cve>CVE-2020-11612</cve>
Ignore CVEs from htrace and ambari transitive deps (#10353) * Ignore CVEs from htrace and ambari transitive deps htrace CVEs are suppressed for now as addressing them requires updating the hadoop version. ambari CVEs are suppressed for now since ambari is updated to the latest version and is no longer actively maintained. * Fix compilation issue from ambari upgrade * Add missing test coverage
2020-09-04 18:22:26 -04:00
</suppress>
<suppress>
<!--
- TODO: The lastest version of ambari-metrics-common is 2.7.0.0.0, released in July 2018.
-->
<notes><![CDATA[
file name: ambari-metrics-common-2.7.0.0.0.jar (shaded: org.apache.hadoop:hadoop-annotations:2.6.0)
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.hadoop/hadoop\-annotations@.*$</packageUrl>
<cve>CVE-2015-1776</cve>
<cve>CVE-2016-3086</cve>
<cve>CVE-2016-5393</cve>
<cve>CVE-2016-6811</cve>
<cve>CVE-2017-3162</cve>
<cve>CVE-2018-11768</cve>
<cve>CVE-2018-1296</cve>
<cve>CVE-2018-8009</cve>
<cve>CVE-2018-8029</cve>
</suppress>
Support for hadoop 3 via maven profiles (#11794) Add support for hadoop 3 profiles . Most of the details are captured in #11791 . We use a combination of maven profiles and resource filtering to achieve this. Hadoop2 is supported by default and a new maven profile with the name hadoop3 is created. This will allow the user to choose the profile which is best suited for the use case.
2021-10-30 13:16:24 -04:00
<suppress>
<notes><![CDATA[
file name: hadoop-*-3.3.1.jar
]]></notes>
<cve>CVE-2018-11765</cve>
<cve>CVE-2020-9492</cve>
Add CVEs for Hadoop3 (#12336) * Add CVEs * Move CVEs under hadoop3 section
2022-06-22 04:42:17 -04:00
<cve>CVE-2021-31684</cve>
<cve>CVE-2021-35517</cve>
<cve>CVE-2021-35516</cve>
<cve>CVE-2021-35515</cve>
<cve>CVE-2021-36090</cve>
Suppress CVE-2022-1278, CVE-2022-2048, CVE-2022-3509, CVE-2022-40152 (#13590)
2022-12-17 09:39:52 -05:00
<cve>CVE-2022-2048</cve>
<cve>CVE-2022-3509</cve>
<cve>CVE-2022-40152</cve>
Support for hadoop 3 via maven profiles (#11794) Add support for hadoop 3 profiles . Most of the details are captured in #11791 . We use a combination of maven profiles and resource filtering to achieve this. Hadoop2 is supported by default and a new maven profile with the name hadoop3 is created. This will allow the user to choose the profile which is best suited for the use case.
2021-10-30 13:16:24 -04:00
</suppress>
Suppress CVE-2017-15288 and upgrade bcprov-ext-jdk15o (#10933)
2021-03-02 19:18:27 -05:00
<suppress>
suppress kafka-clients CVE (#11562) The CVE details are here - https://nvd.nist.gov/vuln/detail/CVE-2021-26291. I am marking it suppressed since we are only using kafka-clients jar in druid. We use maven-artifact jar ourselves but it is only used for comparing versions
2021-08-09 09:32:25 -04:00
<!-- The CVE is not applicable to kafka-clients. -->
Suppress CVE-2017-15288 and upgrade bcprov-ext-jdk15o (#10933)
2021-03-02 19:18:27 -05:00
<notes><![CDATA[
suppress kafka-clients CVE (#11562) The CVE details are here - https://nvd.nist.gov/vuln/detail/CVE-2021-26291. I am marking it suppressed since we are only using kafka-clients jar in druid. We use maven-artifact jar ourselves but it is only used for comparing versions
2021-08-09 09:32:25 -04:00
file name: kafka-clients-2.8.0.jar
Suppress CVE-2017-15288 and upgrade bcprov-ext-jdk15o (#10933)
2021-03-02 19:18:27 -05:00
]]></notes>
suppress kafka-clients CVE (#11562) The CVE details are here - https://nvd.nist.gov/vuln/detail/CVE-2021-26291. I am marking it suppressed since we are only using kafka-clients jar in druid. We use maven-artifact jar ourselves but it is only used for comparing versions
2021-08-09 09:32:25 -04:00
<cve>CVE-2021-26291</cve>
Suppress CVE-2017-15288 and upgrade bcprov-ext-jdk15o (#10933)
2021-03-02 19:18:27 -05:00
</suppress>
Support for hadoop 3 via maven profiles (#11794) Add support for hadoop 3 profiles . Most of the details are captured in #11791 . We use a combination of maven profiles and resource filtering to achieve this. Hadoop2 is supported by default and a new maven profile with the name hadoop3 is created. This will allow the user to choose the profile which is best suited for the use case.
2021-10-30 13:16:24 -04:00
<suppress until="2021-12-30">
<!-- Suppress this until https://github.com/apache/druid/issues/11028 is resolved. -->
<notes><![CDATA[
This vulnerability should be fixed soon and the suppression should be removed.
]]></notes>
<cve>CVE-2020-13949</cve>
</suppress>
suppress (#11002)
2021-03-16 21:17:57 -04:00
Suppress CVEs for Solr and org.codehaus.jackson (#11030) * Suppress CVEs for Solr and org.codehaus.jackson * add a comment
2021-03-24 19:44:05 -04:00
<suppress>
<!-- (ranger, ambari, and aliyun-oss) these vulnerabilities are legit, but their latest releases still use the vulnerable jackson version -->
<notes><![CDATA[
file name: jackson-xc-1.9.x.jar or jackson-jaxrs-1.9.x.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.codehaus\.jackson/jackson-(xc|jaxrs)@1.9.*$</packageUrl>
<cve>CVE-2018-14718</cve>
<cve>CVE-2018-7489</cve>
Port CVE suppressions from 24.0.1 (#13415) * Suppress jackson-databind CVE-2022-42003 and CVE-2022-42004 (cherry picked from commit 1f4d892c9a2dbc3ce6df1481fd4c6d242ba0ea8d) * Suppress CVEs (cherry picked from commit ed55baa8fa7d7f914a0addabb072d9ed47e1cd9f) * Suppress vulnerabilities from druid-website package (cherry picked from commit c0fb364f8049d53cd704e414e2ffeab6c49b012e) * Add more suppressions for website package (cherry picked from commit 9bba569ebd52c5480bf4219c420ed78eb053701f)
2022-11-23 01:05:33 -05:00
<cve>CVE-2022-42003</cve>
<cve>CVE-2022-42004</cve>
</suppress>
<suppress>
<!-- aliyun-oss -->
<notes><![CDATA[
file name: ini4j-0.5.4.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.ini4j/ini4j@.*$</packageUrl>
<vulnerabilityName>CVE-2022-41404</vulnerabilityName>
Suppress CVEs for Solr and org.codehaus.jackson (#11030) * Suppress CVEs for Solr and org.codehaus.jackson * add a comment
2021-03-24 19:44:05 -04:00
</suppress>
<suppress>
Suppress CVEs for jdom2, kafka-clients, libthrift, solr-solrj (#11572)
2021-08-11 06:16:57 -04:00
<!-- Transitive dependency from apache-ranger, latest ranger version 2.1.0 still uses solr 7.7.1-->
<notes><![CDATA[
Suppress CVEs for Solr and org.codehaus.jackson (#11030) * Suppress CVEs for Solr and org.codehaus.jackson * add a comment
2021-03-24 19:44:05 -04:00
file name: solr-solrj-7.7.1.jar
]]></notes>
Suppress CVEs for jdom2, kafka-clients, libthrift, solr-solrj (#11572)
2021-08-11 06:16:57 -04:00
<packageUrl regex="true">^pkg:maven/org\.apache\.solr/solr-solrj@7.7.1$</packageUrl>
<cve>CVE-2020-13957</cve>
<cve>CVE-2019-17558</cve>
<cve>CVE-2019-0193</cve>
<cve>CVE-2020-13941</cve>
<cve>CVE-2021-29943</cve>
<cve>CVE-2021-27905</cve>
<cve>CVE-2021-29262</cve>
CVE suppression (#12535)
2022-05-19 01:51:48 -04:00
<cve>CVE-2021-44548</cve>
Suppress CVEs for jdom2, kafka-clients, libthrift, solr-solrj (#11572)
2021-08-11 06:16:57 -04:00
</suppress>
<suppress>
<!-- Transitive dependency from aliyun-sdk-oss, there is currently no newer version of jdom2 as well-->
<notes><![CDATA[
file name: jdom2-2.0.6.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.jdom/jdom2@2.0.6$</packageUrl>
<cve>CVE-2021-33813</cve>
</suppress>
<suppress>
<!-- Upgrading to libthrift-0.14.2 adds many tomcat CVEs, suppress and stay at 0.13.0 for now-->
<notes><![CDATA[
file name: libthrift-0.13.0.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.thrift/libthrift@0.13.0$</packageUrl>
<cve>CVE-2020-13949</cve>
Suppress CVEs for Solr and org.codehaus.jackson (#11030) * Suppress CVEs for Solr and org.codehaus.jackson * add a comment
2021-03-24 19:44:05 -04:00
</suppress>
suppress hive-storage-api thrift security vulnerability (#11753)
2021-09-29 02:54:13 -04:00
<suppress>
Suppress some false alarm CVEs (#12812) This commit suppresses the following CVEs: - CVE-2021-43138: false alarm for async-http-client - CVE-2021-34538: applicable to Hive server - CVE-2020-25638: requires hibernate update, which causes Hadoop ingestion failure - CVE-2021-27568: false alarm for accessors-smart which is a dependency of json-smart (already suppressed)
2022-07-22 12:57:31 -04:00
<!--
1. hive-storage-api has the thrift vulnerability too
2. CVE-2021-34538 pertains to Hive server.
Suppress false CVEs (#13026) * Suppress CVEs * Add more suppressions
2022-09-06 02:16:56 -04:00
3. CVE-2021-4125 only applies to the OpenShift Metering hive container images
Suppress some false alarm CVEs (#12812) This commit suppresses the following CVEs: - CVE-2021-43138: false alarm for async-http-client - CVE-2021-34538: applicable to Hive server - CVE-2020-25638: requires hibernate update, which causes Hadoop ingestion failure - CVE-2021-27568: false alarm for accessors-smart which is a dependency of json-smart (already suppressed)
2022-07-22 12:57:31 -04:00
-->
suppress hive-storage-api thrift security vulnerability (#11753)
2021-09-29 02:54:13 -04:00
<notes><![CDATA[
file name: hive-storage-api-2.8.1.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@2.8.1$</packageUrl>
<cve>CVE-2020-13949</cve>
Suppress some false alarm CVEs (#12812) This commit suppresses the following CVEs: - CVE-2021-43138: false alarm for async-http-client - CVE-2021-34538: applicable to Hive server - CVE-2020-25638: requires hibernate update, which causes Hadoop ingestion failure - CVE-2021-27568: false alarm for accessors-smart which is a dependency of json-smart (already suppressed)
2022-07-22 12:57:31 -04:00
<cve>CVE-2021-34538</cve>
Suppress false CVEs (#13026) * Suppress CVEs * Add more suppressions
2022-09-06 02:16:56 -04:00
<cve>CVE-2021-4125</cve>
suppress hive-storage-api thrift security vulnerability (#11753)
2021-09-29 02:54:13 -04:00
</suppress>
suppress false positive cve (#11699) * suppress false positive cve * update comment, dont run tests on changes to owasp-dependency-check-suppressions.xml
2021-09-13 23:45:38 -04:00
<suppress>
<!--
the scanner misattributes this to Apache DataSketches
the actual vulnerability affects some collaboration tool called Sketch, and impacts some 'library feeds' feature
which seems to relate to how the tool handles sharing designs or something, so we are doing a blanket ignore
because it seems nearly impossible for us to be affected by this
-->
<cve>CVE-2021-40531</cve>
</suppress>
Support for hadoop 3 via maven profiles (#11794) Add support for hadoop 3 profiles . Most of the details are captured in #11791 . We use a combination of maven profiles and resource filtering to achieve this. Hadoop2 is supported by default and a new maven profile with the name hadoop3 is created. This will allow the user to choose the profile which is best suited for the use case.
2021-10-30 13:16:24 -04:00
<suppress>
<!-- These are for wildfly-openssl. -->
<notes><![CDATA[
file name: wildfly-openssl-1.0.7.Final.jar
]]></notes>
<cve>CVE-2020-10740</cve>
<cve>CVE-2020-25644</cve>
<cve>CVE-2020-10718</cve>
Suppress CVE-2022-1278, CVE-2022-2048, CVE-2022-3509, CVE-2022-40152 (#13590)
2022-12-17 09:39:52 -05:00
<cve>CVE-2022-1278</cve>
Support for hadoop 3 via maven profiles (#11794) Add support for hadoop 3 profiles . Most of the details are captured in #11791 . We use a combination of maven profiles and resource filtering to achieve this. Hadoop2 is supported by default and a new maven profile with the name hadoop3 is created. This will allow the user to choose the profile which is best suited for the use case.
2021-10-30 13:16:24 -04:00
</suppress>
<suppress>
<!-- Suppress aws-java-sdk-bundle cves -->
<notes><![CDATA[
file name: aws-java-sdk-bundle-1.11.901.jar
]]></notes>
<cve>CVE-2020-8570</cve>
<cve>CVE-2015-8559</cve>
<cve>CVE-2021-20291</cve>
<cve>CVE-2017-17485</cve>
<cve>CVE-2018-5968</cve>
<cve>CVE-2017-15095</cve>
<cve>CVE-2019-16942</cve>
<cve>CVE-2020-25649</cve>
<cve>CVE-2020-35491</cve>
<cve>CVE-2019-16943</cve>
<cve>CVE-2020-35490</cve>
<cve>CVE-2019-20330</cve>
<cve>CVE-2020-10673</cve>
<cve>CVE-2018-11307</cve>
<cve>CVE-2018-7489</cve>
<cve>CVE-2019-17267</cve>
<cve>CVE-2019-17531</cve>
<cve>CVE-2019-16335</cve>
<cve>CVE-2019-14893</cve>
<cve>CVE-2019-14540</cve>
Add CVEs for Hadoop3 (#12336) * Add CVEs * Move CVEs under hadoop3 section
2022-06-22 04:42:17 -04:00
<cve>CVE-2021-37136</cve>
<cve>CVE-2021-37137</cve>
Support for hadoop 3 via maven profiles (#11794) Add support for hadoop 3 profiles . Most of the details are captured in #11791 . We use a combination of maven profiles and resource filtering to achieve this. Hadoop2 is supported by default and a new maven profile with the name hadoop3 is created. This will allow the user to choose the profile which is best suited for the use case.
2021-10-30 13:16:24 -04:00
</suppress>
<suppress>
<!-- Suppress hadoop-shaded-guava cves -->
<notes><![CDATA[
file name: hadoop-shaded-guava-1.1.1.jar
]]></notes>
<cve>CVE-2015-7430</cve>
<cve>CVE-2017-3162</cve>
</suppress>
CVE fixes - update of multiple dependencies. (#14519) Apache Druid brings multiple direct and transitive dependencies that are affected by plethora of CVEs. This PR attempts to update all the dependencies that did not require code refactoring. This PR modifies pom files, license file and OWASP Dependency Check suppression file.
2023-07-07 10:57:30 -04:00
Suppress Avro CVEs (#12166)
2022-01-18 10:39:48 -05:00
<suppress>
<!-- Suppress avro cves that are only applicable to .NET SDK-->
<notes><![CDATA[
file name: avro-1.9.2.jar or avro-ipc-jetty-1.9.2.jar
]]></notes>
<cve>CVE-2021-43045</cve>
</suppress>
Suppress CVE-2021-43138 (#12437) * Suppress CVE-2021-43138 * revert netty 3.10.5.Final
2022-04-18 23:00:06 -04:00
<suppress>
<!-- False alarm for the Async javascript library (https://github.com/caolan/async) which is a dev dependency for the web console -->
<notes><![CDATA[
file name: async-http-client-netty-utils-2.5.3.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.asynchttpclient/async-http-client-netty-utils@2.5.3$</packageUrl>
<cve>CVE-2021-43138</cve>
</suppress>
Supress CVE 2022 26612 (#12463) * supress CVE-2022-26612 * adding packageUrl * suppressing CVE-2022-26612 * adding packageUrl * moving to hadoop section
2022-04-21 11:48:20 -04:00
Suppress some false alarm CVEs (#12812) This commit suppresses the following CVEs: - CVE-2021-43138: false alarm for async-http-client - CVE-2021-34538: applicable to Hive server - CVE-2020-25638: requires hibernate update, which causes Hadoop ingestion failure - CVE-2021-27568: false alarm for accessors-smart which is a dependency of json-smart (already suppressed)
2022-07-22 12:57:31 -04:00
<suppress>
<!-- False alarm for the Async javascript library (https://github.com/caolan/async) which is a dev dependency for the web console -->
<notes><![CDATA[
file name: async-http-client-2.5.3.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.asynchttpclient/async-http-client@2.5.3$</packageUrl>
<cve>CVE-2021-43138</cve>
</suppress>
CVE suppression (#12535)
2022-05-19 01:51:48 -04:00
<suppress>
<!-- Jackson CVEs when processing objects of large depth. Consider updating -->
Fixing security vulnerability check errors (#13956) * Fixing security vulnerability check errors * Updating javax.el to jakarta.el * Adding cron job trigger on changes to suppressions file
2023-03-23 01:40:06 -04:00
CVE suppression (#12535)
2022-05-19 01:51:48 -04:00
<notes><![CDATA[
file name: *jackson-*.jar
]]></notes>
Fixing security vulnerability check errors (#13956) * Fixing security vulnerability check errors * Updating javax.el to jakarta.el * Adding cron job trigger on changes to suppressions file
2023-03-23 01:40:06 -04:00
<cve>CVE-2022-45688</cve>
CVE suppression (#12535)
2022-05-19 01:51:48 -04:00
</suppress>
<suppress>
<!-- Non-applicable CVE for gson -->
<notes><![CDATA[
file name: gson-*.jar
]]></notes>
<cve>CVE-2022-25647</cve>
</suppress>
<suppress>
<!-- Non-applicable CVE for jedis, since we don't use lua scripts -->
<notes><![CDATA[
file name: jedis-2.9.0.jar
]]></notes>
<cve>CVE-2021-32626</cve>
<cve>CVE-2022-24735</cve>
</suppress>
Suppress CVEs (#12553)
2022-05-23 03:05:23 -04:00
<suppress>
<!-- pac4j-core-3.8.3 -->
<notes><![CDATA[
file name: pac4j-core-3.8.3.jar
]]></notes>
<cve>CVE-2021-44878</cve>
</suppress>
Suppress CVEs (#12590)
2022-06-01 11:52:32 -04:00
<suppress>
<!-- cassandra-all-1.0.8.jar -->
<notes><![CDATA[
file name: cassandra-all-1.0.8.jar
]]></notes>
<cve>CVE-2020-17516</cve>
</suppress>
<suppress>
<!-- okhttp -->
<notes><![CDATA[
file name: okhttp-*.jar
]]></notes>
<cve>CVE-2021-0341</cve>
Suppress CVEs (#14648) CVE-2023-34462 - (Allows malicious allocation of resources without throttling) Not applicable as the Netty requests in Druid are internal, and not user facing. CVE-2016-2402 - (Man in the middle with okhttp by sending certificate chains) Not applicable as okhttp requests in Druid are also internal
2023-07-25 04:07:50 -04:00
<cve>CVE-2016-2402</cve> <!-- Suppressed since okhttp requests in Druid are internal, and not user-facing -->
Suppress CVEs (#12590)
2022-06-01 11:52:32 -04:00
</suppress>
<suppress>
<!-- parquet-format-structures-1.12.0.jar -->
<notes><![CDATA[
file name: parquet-format-structures-1.12.0.jar
]]></notes>
<cve>CVE-2021-41561</cve>
</suppress>
Suppress CVEs - Avatica, Postgres (#12884)
2022-08-10 04:48:19 -04:00
<suppress>
<!-- Avatica server itself is not affected. Vulnerability exists only on client. -->
<notes><![CDATA[
file name: avatica-server-1.17.0.jar
]]></notes>
<cve>CVE-2022-36364</cve>
Port CVE suppressions from 24.0.1 (#13415) * Suppress jackson-databind CVE-2022-42003 and CVE-2022-42004 (cherry picked from commit 1f4d892c9a2dbc3ce6df1481fd4c6d242ba0ea8d) * Suppress CVEs (cherry picked from commit ed55baa8fa7d7f914a0addabb072d9ed47e1cd9f) * Suppress vulnerabilities from druid-website package (cherry picked from commit c0fb364f8049d53cd704e414e2ffeab6c49b012e) * Add more suppressions for website package (cherry picked from commit 9bba569ebd52c5480bf4219c420ed78eb053701f)
2022-11-23 01:05:33 -05:00
<cve>CVE-2022-39135</cve>
</suppress>
<suppress>
<notes><![CDATA[
file name: calcite-core-1.21.0.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.calcite/calcite\-core@.*$</packageUrl>
<cve>CVE-2020-13955</cve>
Suppress CVEs - Avatica, Postgres (#12884)
2022-08-10 04:48:19 -04:00
</suppress>
Suppress Calcite CVE (#13119) * Suppress Calcite CVE * Update comment
2022-09-23 06:53:26 -04:00
<suppress>
<!-- avatica-server-1.17.0.jar -->
<notes><![CDATA[
file name: avatica-server-1.17.0.jar
]]></notes>
<!--
We do not expose any of the SQL operators that were found vulnerable in this CVE.
-->
<cve>CVE-2022-39135</cve>
</suppress>
<suppress>
<!-- calcite-core-1.21.0.jar -->
<notes><![CDATA[
file name: calcite-core-1.21.0.jar
]]></notes>
<!--
We do not expose any of the SQL operators that were found vulnerable in this CVE.
-->
<cve>CVE-2022-39135</cve>
</suppress>
Suppressing package-lock.json?d3-color vulnerability (#13301)
2022-11-04 02:17:02 -04:00
<suppress>
<!-- package-lock.json?d3-color -->
<notes><![CDATA[
file name: d3-color:2.0.0
]]></notes>
<!--
Suppress CVEs (#13733)
2023-02-01 07:18:41 -05:00
Not vulnerable to these as, we use d3-color on the client only.
Suppressing package-lock.json?d3-color vulnerability (#13301)
2022-11-04 02:17:02 -04:00
-->
<packageUrl regex="true">^pkg:npm/d3\-color@.*$</packageUrl>
<vulnerabilityName>1084597</vulnerabilityName>
Suppress CVEs (#13733)
2023-02-01 07:18:41 -05:00
<vulnerabilityName>1088594</vulnerabilityName>
Suppressing package-lock.json?d3-color vulnerability (#13301)
2022-11-04 02:17:02 -04:00
</suppress>
Port CVE suppressions from 24.0.1 (#13415) * Suppress jackson-databind CVE-2022-42003 and CVE-2022-42004 (cherry picked from commit 1f4d892c9a2dbc3ce6df1481fd4c6d242ba0ea8d) * Suppress CVEs (cherry picked from commit ed55baa8fa7d7f914a0addabb072d9ed47e1cd9f) * Suppress vulnerabilities from druid-website package (cherry picked from commit c0fb364f8049d53cd704e414e2ffeab6c49b012e) * Add more suppressions for website package (cherry picked from commit 9bba569ebd52c5480bf4219c420ed78eb053701f)
2022-11-23 01:05:33 -05:00
<suppress>
<notes><![CDATA[
file name: d3-color:2.0.0
]]></notes>
<packageUrl regex="true">^pkg:npm/d3\-color@.*$</packageUrl>
<vulnerabilityName>1084597</vulnerabilityName>
</suppress>
<suppress>
<notes><![CDATA[
file name: protobuf-java-3.11.0.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/com\.google\.protobuf/protobuf\-java@.*$</packageUrl>
<cve>CVE-2022-3171</cve>
</suppress>
<suppress>
<notes><![CDATA[
file name: protobuf-java-util-3.11.0.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/com\.google\.protobuf/protobuf\-java\-util@.*$</packageUrl>
<cve>CVE-2022-3171</cve>
</suppress>
<suppress>
<notes><![CDATA[
file name: ansi-regex:5.0.0
]]></notes>
<packageUrl regex="true">^pkg:npm/ansi\-regex@.*$</packageUrl>
<vulnerabilityName>1084697</vulnerabilityName>
<cve>CVE-2021-3807</cve>
</suppress>
<suppress>
<notes><![CDATA[
file name: glob-parent:5.1.1
]]></notes>
<packageUrl regex="true">^pkg:npm/glob\-parent@.*$</packageUrl>
<vulnerabilityName>1081884</vulnerabilityName>
<cve>CVE-2020-28469</cve>
</suppress>
<suppress>
<notes><![CDATA[
file name: minimatch:3.0.4
]]></notes>
<packageUrl regex="true">^pkg:npm/minimatch@.*$</packageUrl>
<vulnerabilityName>1084765</vulnerabilityName>
</suppress>
<suppress>
<notes><![CDATA[
file name: y18n:4.0.0
]]></notes>
<packageUrl regex="true">^pkg:npm/y18n@.*$</packageUrl>
<vulnerabilityName>1070209</vulnerabilityName>
<cve>CVE-2020-7774</cve>
</suppress>
suppress some cves and fix javadoc build when using java 17 (#14241)
2023-05-10 18:47:10 -04:00
<suppress>
<!-- druid-ranger-security -->
<notes><![CDATA[
file name: ranger-plugins-common-2.0.0.jar
]]></notes>
<!-- seems not applicable to plugin -->
<cve>CVE-2022-45048</cve>
</suppress>
suppress hadoop3 cve that seem not applicable to us (#14252)
2023-05-11 02:08:05 -04:00
<suppress>
<!-- from extensions using hadoop-client-runtime, these dependencies are shaded in the jar -->
<notes><![CDATA[
update hadoop version to 3.3.6 (#14489)
2023-06-28 05:33:10 -04:00
file name: hadoop-client-runtime-3.3.6.jar
suppress hadoop3 cve that seem not applicable to us (#14252)
2023-05-11 02:08:05 -04:00
]]></notes>
<!-- this one is windows only - https://nvd.nist.gov/vuln/detail/CVE-2022-26612 -->
<cve>CVE-2022-26612</cve>
<!-- this one seems to apply to backend server - https://nvd.nist.gov/vuln/detail/CVE-2023-25613 -->
<cve>CVE-2023-25613</cve>
Suppress CVEs (#14291) Address various CVEs by upgrading dependencies or adding suppression with a justification
2023-07-10 05:49:26 -04:00
<cve>CVE-2023-2976</cve> <!-- hadoop-client-runtime isn't using com.google.common.io.FileBackedOutputStream -->
Fix reported CVEs (#14882) Suppress CVEs from dependencies with no available fix or false positives hadoop-annotations: CVE-2022-25168, CVE-2021-33036 hadoop-client-runtime: CVE-2023-1370, CVE-2023-37475 okio: CVE-2023-3635 Upgrade grpc version to fix CVE-2023-33953
2023-08-24 09:58:55 -04:00
<!-- CVE from shaded dependency nimbus-jose-jwt, fixed in upcoming Hadoop release version -
https://github.com/apache/hadoop/commit/ad49ddda0e1d9632c8c9fcdc78fca8244e1248c9 -->
<cve>CVE-2023-1370</cve>
<cve>CVE-2023-37475</cve> <!-- Suppressing since CVE wrongly linked to apache:avro project - https://github.com/jeremylong/DependencyCheck/issues/5843 -->
Resolve reported CVEs (#15081)
2023-10-04 02:29:01 -04:00
<cve>CVE-2023-39410</cve> <!-- This seems to be a legitimate vulnerability. But there is no fix as of yet in Hadoop repo -->
Suppress CVE's in master (#15231)
2023-10-26 23:59:18 -04:00
<cve>CVE-2023-44487</cve> <!-- Occurs in the version of Hadoop used by Jetty, but it hasn't been fixed by Hadoop yet-->
Suppress CVEs (#14291) Address various CVEs by upgrading dependencies or adding suppression with a justification
2023-07-10 05:49:26 -04:00
</suppress>
<suppress>
<!-- from extensions using hadoop-client-api, these dependencies are shaded in the jar -->
<notes><![CDATA[
file name: hadoop-client-api-3.3.6.jar: jquery.dataTables.min.js (pkg:javascript/jquery.datatables@1.10.18)
]]></notes>
<vulnerabilityName>prototype pollution</vulnerabilityName>
Suppress CVE's in master (#15231)
2023-10-26 23:59:18 -04:00
<cve>CVE-2020-28458</cve>
suppress hadoop3 cve that seem not applicable to us (#14252)
2023-05-11 02:08:05 -04:00
</suppress>
suppress CVE-2021-40331 since it applies to ranger-hive-plugin which afaict we do not use (#14261)
2023-05-12 00:58:47 -04:00
<suppress>
<notes><![CDATA[
file name: ranger-plugins-*-2.0.0.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.ranger/ranger\-plugins\-.*@2.0.0$</packageUrl>
<!-- applies to ranger-hive-plugin which afaict we do not use https://nvd.nist.gov/vuln/detail/CVE-2021-40331 -->
<cve>CVE-2021-40331</cve>
</suppress>
Suppress CVEs (#14291) Address various CVEs by upgrading dependencies or adding suppression with a justification
2023-07-10 05:49:26 -04:00
<!-- filed against random script set, doesn't apply to any Maven artifacts - https://github.com/jeremylong/DependencyCheck/issues/5213 -->
<suppress>
<notes><![CDATA[
file name: plexus-utils-3.0.24.jar
file name: async-http-client-netty-utils-2.5.3.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/.*/.*@.*$</packageUrl>
<cve>CVE-2021-4277</cve>
</suppress>
Fix reported CVEs (#14882) Suppress CVEs from dependencies with no available fix or false positives hadoop-annotations: CVE-2022-25168, CVE-2021-33036 hadoop-client-runtime: CVE-2023-1370, CVE-2023-37475 okio: CVE-2023-3635 Upgrade grpc version to fix CVE-2023-33953
2023-08-24 09:58:55 -04:00
<suppress>
<notes><![CDATA[
file name: okio-1.17.2.jar, okio-1.15.0.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/com\.squareup\.okio/okio@1..*$</packageUrl>
<cve>CVE-2023-3635</cve> <!-- Suppressed since okio requests in Druid are internal, and not user-facing -->
</suppress>
skip org.owasp:dependency-check on extensions-contrib modules and suppress false-positive gRPC CVEs (#15026)
2023-09-25 02:44:42 -04:00
<suppress>
<notes><![CDATA[
file name: grpc-context-1.27.2.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/io\.grpc/grpc-context@1.27.2$</packageUrl>
<cve>CVE-2023-4785</cve> <!-- Not applicable to gRPC Java - https://nvd.nist.gov/vuln/detail/CVE-2023-4785 -->
<cve>CVE-2023-33953</cve> <!-- Not applicable to gRPC Java - https://cloud.google.com/support/bulletins#gcp-2023-022 -->
</suppress>
Resolve reported CVEs (#15081)
2023-10-04 02:29:01 -04:00
<!-- CVE-2022-4244 is affecting plexus-utils package, plexus-interpolation is wrongly matched - https://github.com/jeremylong/DependencyCheck/issues/5973 -->
<suppress base="true">
<packageUrl regex="true">^pkg:maven/org\.codehaus\.plexus/plexus-interpolation@.*$</packageUrl>
<cve>CVE-2022-4244</cve>
</suppress>
Suppress CVE's in master (#15231)
2023-10-26 23:59:18 -04:00
<!-- CVE-2023-5072 has a too broad CPE that seems to be flagging dependencies like json-*. Neither Druid nor any of its
~ transitive dependency use json-java which contains the vulnerability-->
<suppress base="true">
<cve>CVE-2023-5072</cve>
</suppress>
<!--
~ CVE-2023-44981 seems to affect Zookeeper servers. While we ship with a previous version of the Zookeeper, Druid only
~ only uses the client classes of the Zookeeper. We do use the older version in the quickstart & example docker file,
~ however in production it is recomended to use your own Zookeeper server with the CVE patched up, which the Druid's
~ older ZK library is still compatible with.
-->
<suppress>
<notes><![CDATA[
file name: zookeeper-3.5.10.jar
]]></notes>
<cve>CVE-2023-44981</cve>
</suppress>
<!--
~ Hostname verification is disabled by default in Netty 4.x, therefore the version that Druid is using gets flagged,
~ however Druid enables it in ChannelResourceFactory therefore this is a false positive-->
<suppress>
<notes><![CDATA[
file name: netty-transport-4.1.100.Final.jar
]]></notes>
<cve>CVE-2023-4586</cve>
</suppress>
Address security vulnerabilities CVSS >= 7 (#8980) * Address security vulnerabilities CVSS >= 7 Update dependencies to address security vulnerabilities with CVSS scores of 7 or higher. A new Travis CI job is added to prevent new high/critical security vulnerabilities from being added. Updated dependencies: - api-util 1.0.0 -> 1.0.3 - jackson 2.9.10 -> 2.10.1 - kafka 2.1.0 -> 2.1.1 - libthrift 0.10.0 -> 0.13.0 - protobuf 3.2.0 -> 3.11.0 The following high/critical security vulnerabilities are currently suppressed (so that the new Travis CI job can be added now) and are left as future work to fix: - hibernate-validator:5.2.5 - jackson-mapper-asl:1.9.13 - libthrift:0.6.1 - netty:3.10.6 - nimbus-jose-jwt:4.41.1 * Rename EDL1 license file * Fix inspection errors
2019-12-05 17:34:35 -05:00
</suppressions>