From b6952f124629fec201d479105d9246647788fd0a Mon Sep 17 00:00:00 2001 From: exceptionfactory Date: Thu, 24 Oct 2024 16:58:07 -0500 Subject: [PATCH] NIFI-13933 Upgraded Spring Security to 6.3.4 and other dependencies This closes #9450 - Upgraded Spring Security from 6.3.3 to 6.3.4 - Upgraded Hadoop from 3.4.0 to 3.4.1 - Upgraded Velocity Engine Core from 2.3.0 to 2.4.1 - Upgraded Parquet Avro from 1.13.1 to 1.14.3 - Upgraded Google Libraries from 26.47.0 to 26.49.0 - Set protobuf-java to 3.25.5 for calcite-core and amazon-kinesis-client libraries - Updated Dependency Check suppressions Signed-off-by: Joseph Witt --- nifi-code-coverage/pom.xml | 6 ++ nifi-commons/nifi-calcite-utils/pom.xml | 6 ++ nifi-dependency-check-maven/suppressions.xml | 78 +++++++------------ .../nifi-aws-bundle/pom.xml | 6 ++ .../gcp/storage/AbstractGCSTest.java | 2 +- .../nifi-gcp-bundle/pom.xml | 2 +- .../nifi-parquet-processors/pom.xml | 2 +- .../nifi-registry-test/pom.xml | 7 ++ pom.xml | 11 ++- 9 files changed, 64 insertions(+), 56 deletions(-) diff --git a/nifi-code-coverage/pom.xml b/nifi-code-coverage/pom.xml index 1b8c2fc49a..bbf2d810fc 100644 --- a/nifi-code-coverage/pom.xml +++ b/nifi-code-coverage/pom.xml @@ -113,6 +113,12 @@ apache-mime4j-core ${mime4j.version} + + + com.google.protobuf + protobuf-java + 3.25.5 + diff --git a/nifi-commons/nifi-calcite-utils/pom.xml b/nifi-commons/nifi-calcite-utils/pom.xml index fc7a69e4f6..c7c66e2ecd 100644 --- a/nifi-commons/nifi-calcite-utils/pom.xml +++ b/nifi-commons/nifi-calcite-utils/pom.xml @@ -65,6 +65,12 @@ + + + com.google.protobuf + protobuf-java + 3.25.5 + diff --git a/nifi-dependency-check-maven/suppressions.xml b/nifi-dependency-check-maven/suppressions.xml index 19021551ee..e71529a3dc 100644 --- a/nifi-dependency-check-maven/suppressions.xml +++ b/nifi-dependency-check-maven/suppressions.xml @@ -19,16 +19,6 @@ ^pkg:maven/org\.apache\.nifi.*$ ^cpe:.*$ - - CVE-2017-10355 does not apply to Xerces 2.12.2 - ^pkg:maven/xerces/xercesImpl@.*$ - CVE-2017-10355 - - - CVE-2007-6465 applies to Ganglia Server not Ganglia client libraries - ^pkg:maven/com\.yammer\.metrics/metrics\-ganglia@.*$ - CVE-2007-6465 - Elasticsearch Server vulnerabilities do not apply to elasticsearch-rest-client ^pkg:maven/org\.elasticsearch\.client/elasticsearch\-.*?\-client@.*$ @@ -44,11 +34,6 @@ ^pkg:maven/com\.azure/azure\-messaging\-eventhubs\-checkpointstore\-blob@.*$ CVE-2022-30187 - - CVE-2010-1151 applies to mod_auth_shadow in Apache HTTP Server not the FTP server library - ^pkg:maven/org\.apache\.ftpserver/.*$ - CVE-2010-1151 - CVE-2018-14335 applies to H2 running with a web server console enabled ^pkg:maven/com\.h2database/h2@.*$ @@ -69,16 +54,6 @@ ^pkg:maven/com\.google\.api\.grpc/grpc\-google\-cloud\-pubsublite\-v1@.*$ cpe:/a:grpc:grpc - - CVE-2020-9040 applies to Couchbase Server not the client library - ^pkg:maven/com\.couchbase\.client/core\-io@.*$ - CVE-2020-9040 - - - CVE-2022-41881 applies to HA Proxy components in Netty which are not used in Couchbase or other components - ^pkg:maven/io\.netty/.*$ - CVE-2022-41881 - CVE-2021-34538 applies to Apache Hive server not the Storage API library ^pkg:maven/org\.apache\.hive/hive\-storage\-api@.*$ @@ -94,16 +69,6 @@ ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$ CVE-2023-35116 - - CVE-2023-25194 applies to Kafka Connect workers not client libraries - ^pkg:maven/org\.apache\.kafka/kafka.*?@.*$ - CVE-2023-25194 - - - CVE-2023-34462 applies to Netty servers using SniHandler not Netty 4.1 shaded for Couchbase and HBase 2 - ^pkg:maven/io\.netty/netty.*$ - CVE-2023-34462 - The Square Wire framework is not the same as the Wire secure communication application ^pkg:maven/com\.squareup\.wire/.*$ @@ -189,11 +154,6 @@ ^pkg:maven/org\.apache\.hive.*$ CVE-2020-13949 - - CVE-2023-44487 applies to netty-codec-http2 as a Server - ^pkg:maven/io\.netty/netty.*$ - CVE-2023-44487 - Parquet MR vulnerabilities do not apply to other Parquet libraries ^pkg:maven/org\.apache\.parquet/parquet\-(?!mr).*$ @@ -234,11 +194,6 @@ ^pkg:javascript/jquery@.*$ CVE-2020-7656 - - jQuery vulnerability warning for historical versions - ^pkg:javascript/jquery@.*$ - jQuery 1.x and 2.x are End-of-Life and no longer receiving security updates - CVE-2023-44487 references gRPC for Go ^pkg:maven/io\.grpc/grpc.*$ @@ -254,14 +209,9 @@ ^pkg:maven/com\.google\.guava/guava@.*$ CVE-2020-8908 - - CVE-2023-36052 applies to Azure CLI not Azure Java libraries - ^pkg:maven/com\.azure/.*$ - CVE-2023-36052 - Findings for Apache Hadoop do not apply to the shaded Protobuf library - ^pkg:maven/org\.apache\.hadoop\.thirdparty/hadoop\-shaded\-protobuf_3_21@.*$ + ^pkg:maven/org\.apache\.hadoop\.thirdparty/hadoop\-shaded\-protobuf_3_25@.*$ cpe:/a:apache:hadoop @@ -274,4 +224,30 @@ ^pkg:maven/org\.threeten/threetenbp@.*$ CVE-2024-23082 + + CVE-2023-7272 applies to Eclipse Parrson not javax.json + ^pkg:maven/org\.glassfish/javax\.json@.*$ + CVE-2023-7272 + + + CVE-2024-43591 applies to Azure CLI not azure-core-amqp + ^pkg:maven/com\.azure/.*$ + cpe:/a:microsoft:azure_cli + CVE-2024-43591 + + + jquery is not used although bundled in Hadoop avro-ipc libraries + ^pkg:javascript/jquery@.*$ + jquery issue: 162 + + + Google OpenTelemetry shared-resourcemapping versions do not align with base OpenTelemetry versions leading to false positives + ^pkg:maven/com\.google\.cloud\.opentelemetry/.*$ + cpe:/a:opentelemetry:opentelemetry + + + CVE-2024-35255 is resolved in msal4j 1.15.1 and the CPE for other languages does not apply + CVE-2024-35255 + cpe:/a:microsoft:authentication_library:*:*:*:*:*:.net:*:* + diff --git a/nifi-extension-bundles/nifi-aws-bundle/pom.xml b/nifi-extension-bundles/nifi-aws-bundle/pom.xml index fa13da9a30..ee8e5513cd 100644 --- a/nifi-extension-bundles/nifi-aws-bundle/pom.xml +++ b/nifi-extension-bundles/nifi-aws-bundle/pom.xml @@ -66,6 +66,12 @@ + + + com.google.protobuf + protobuf-java + 3.25.5 + diff --git a/nifi-extension-bundles/nifi-gcp-bundle/nifi-gcp-processors/src/test/java/org/apache/nifi/processors/gcp/storage/AbstractGCSTest.java b/nifi-extension-bundles/nifi-gcp-bundle/nifi-gcp-processors/src/test/java/org/apache/nifi/processors/gcp/storage/AbstractGCSTest.java index 99289558de..8d57214f6f 100644 --- a/nifi-extension-bundles/nifi-gcp-bundle/nifi-gcp-processors/src/test/java/org/apache/nifi/processors/gcp/storage/AbstractGCSTest.java +++ b/nifi-extension-bundles/nifi-gcp-bundle/nifi-gcp-processors/src/test/java/org/apache/nifi/processors/gcp/storage/AbstractGCSTest.java @@ -45,7 +45,7 @@ import static org.mockito.Mockito.reset; @ExtendWith(MockitoExtension.class) public abstract class AbstractGCSTest { private static final String PROJECT_ID = System.getProperty("test.gcp.project.id", "nifi-test-gcp-project"); - private static final String DEFAULT_STORAGE_URL = "https://storage.googleapis.com"; + private static final String DEFAULT_STORAGE_URL = "https://storage.googleapis.com/"; private static final Integer RETRIES = 9; static final String BUCKET = RemoteStorageHelper.generateBucketName(); diff --git a/nifi-extension-bundles/nifi-gcp-bundle/pom.xml b/nifi-extension-bundles/nifi-gcp-bundle/pom.xml index fc5c09bc38..bcfbb57ae3 100644 --- a/nifi-extension-bundles/nifi-gcp-bundle/pom.xml +++ b/nifi-extension-bundles/nifi-gcp-bundle/pom.xml @@ -25,7 +25,7 @@ pom - 26.47.0 + 26.49.0 diff --git a/nifi-extension-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml b/nifi-extension-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml index 3e6d3adfcb..d2def3d699 100644 --- a/nifi-extension-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml +++ b/nifi-extension-bundles/nifi-parquet-bundle/nifi-parquet-processors/pom.xml @@ -87,7 +87,7 @@ org.apache.parquet parquet-avro - 1.13.1 + 1.14.3 org.xerial.snappy diff --git a/nifi-registry/nifi-registry-core/nifi-registry-test/pom.xml b/nifi-registry/nifi-registry-core/nifi-registry-test/pom.xml index 03a68ee334..c8a5888054 100644 --- a/nifi-registry/nifi-registry-core/nifi-registry-test/pom.xml +++ b/nifi-registry/nifi-registry-core/nifi-registry-test/pom.xml @@ -63,6 +63,13 @@ com.mysql mysql-connector-j 9.1.0 + + + + com.google.protobuf + protobuf-java + + org.mariadb.jdbc diff --git a/pom.xml b/pom.xml index fd83d7ec5b..8cc22a16f0 100644 --- a/pom.xml +++ b/pom.xml @@ -142,7 +142,7 @@ 2.5.1 4.0.23 3.5.1 - 3.4.0 + 3.4.1 1.2.1 2.1.5 1.9.22.1 @@ -155,7 +155,7 @@ 4.1.114.Final 6.1.0 6.1.14 - 6.3.3 + 6.3.4 2.2.25 2.3.232 3.9.2 @@ -163,6 +163,7 @@ 2.5.1 2.12.0 0.16.0 + 2.4.1 @@ -559,6 +560,12 @@ zookeeper-jute ${zookeeper.version} + + + org.apache.velocity + velocity-engine-core + ${velocity-engine-core.version} + junit