Skip to content

Address security vulnerabilities#8878

Merged
gianm merged 4 commits intoapache:masterfrom
ccaominh:security-update-11-2019
Nov 19, 2019
Merged

Address security vulnerabilities#8878
gianm merged 4 commits intoapache:masterfrom
ccaominh:security-update-11-2019

Conversation

@ccaominh
Copy link
Copy Markdown
Contributor

@ccaominh ccaominh commented Nov 16, 2019 •
edited
Loading

Fixes #4798.
Fixes #6347.

Description

Security vulnerabilities addressed by upgrading 3rd party libs:

Note that if users are using JDBC lookups with postgres, they may need to update the JDBC jar used by the lookup extension.

This PR has:

  • been self-reviewed.
  • added documentation for new or modified features or behaviors.
  • added or updated version, license, or notice information in licenses.yaml
  • added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
  • been tested in a test Druid cluster.

@ccaominh
Address security vulnerabilities
4cbde59 
Security vulnerabilities addressed by upgrading 3rd party libs:

- Upgrade avro-ipc to 1.9.1
  - sonatype-2019-0115
- Upgrade caffeine to 2.8.0
  - sonatype-2019-0282
- Upgrade commons-beanutils to 1.9.4
  - CVE-2014-0114
- Upgrade commons-codec to 1.13
  - sonatype-2012-0050
- Upgrade commons-compress to 1.19
  - CVE-2019-12402
  - sonatype-2018-0293
- Upgrade hadoop-common to 2.8.5
  - CVE-2018-11767
- Upgrade hadoop-mapreduce-client-core to 2.8.5
  - CVE-2017-3166
- Upgrade hibernate-validator to 5.2.5
  - CVE-2017-7536
- Upgrade httpclient to 4.5.10
  - sonatype-2017-0359
- Upgrade icu4j to 55.1
  - CVE-2014-8147
- Upgrade jackson-databind to 2.6.7.3:
  - CVE-2017-7525
- Upgrade jetty-http to 9.4.12:
  - CVE-2017-7657
  - CVE-2017-7658
  - CVE-2017-7656
  - CVE-2018-12545
- Upgrade log4j-core to 2.8.2
  - CVE-2017-5645:
- Upgrade netty to 3.10.6
  - CVE-2015-2156
- Upgrade netty-common to 4.1.42
  - CVE-2019-9518
- Upgrade netty-codec-http to 4.1.42
  - CVE-2019-16869
- Upgrade nimbus-jose-jwt to 4.41.1
  - CVE-2017-12972
  - CVE-2017-12974
- Upgrade plexus-utils to 3.0.24
  - CVE-2017-1000487
  - sonatype-2015-0173
  - sonatype-2016-0398
- Upgrade postgresql to 42.2.8
  - CVE-2018-10936

Note that if users are using JDBC lookups with postgres, they may need
to update the JDBC jar used by the lookup extension.
@ccaominh
Fix license for postgresql
a3a34b7
@ccaominh
Copy link
Copy Markdown
Contributor Author

ccaominh commented Nov 17, 2019

I believe the Travis failure is due to a flaky integration test as the test passed for the first commit (https://travis-ci.org/apache/incubator-druid/builds/612644687?utm_source=github_status&utm_medium=notification) and the second commit only changed code related to license checking.

@gianm
Copy link
Copy Markdown
Contributor

gianm commented Nov 17, 2019

I restarted the travis job that failed.

The LGTM analysis seems hung up on an npm step. @vogievetsky or other npm gurus - any idea what might be going on here? (I've seen a similar error on other PRs.)

[2019-11-16 05:22:35] [autobuild] [INFO] Running 'npm ci' in /opt/src/web-console
[2019-11-16 05:24:03] [autobuild] [ERROR] npm ERR! code E400
[2019-11-16 05:24:03] [autobuild] [ERROR] npm ERR! 400 Bad Request: domhandler@2.4.2
[2019-11-16 05:24:33] [autobuild] [ERROR] 
[2019-11-16 05:24:33] [autobuild] [ERROR] npm ERR! A complete log of this run can be found in:
[2019-11-16 05:24:33] [autobuild] [ERROR] npm ERR!     /opt/work/.npm/_logs/2019-11-16T05_24_03_938Z-debug.log

@jnaous
Copy link
Copy Markdown
Contributor

jnaous commented Nov 17, 2019 via email

@vogievetsky vogievetsky mentioned this pull request Nov 17, 2019
Merged
@vogievetsky
Copy link
Copy Markdown
Contributor

vogievetsky commented Nov 17, 2019

Strange, nothing changed in the npm deps lately also npm ci works for me locally even after clearing all caches and it seems to work in Travis

@gianm
Copy link
Copy Markdown
Contributor

gianm commented Nov 19, 2019

@ccaominh Have you tested this with a live Druid + live Hadoop cluster combination?

@gianm
Copy link
Copy Markdown
Contributor

gianm commented Nov 19, 2019

@ccaominh Could you also try merging in master, it should fix LGTM.

@ccaominh
Copy link
Copy Markdown
Contributor Author

ccaominh commented Nov 19, 2019

@gianm I've tested with the hadoop tutorial (https://druid.apache.org/docs/latest/tutorials/tutorial-batch-hadoop.html). Are there additional tests you suggest?

@gianm
Copy link
Copy Markdown
Contributor

gianm commented Nov 19, 2019

@gianm I've tested with the hadoop tutorial (https://druid.apache.org/docs/latest/tutorials/tutorial-batch-hadoop.html). Are there additional tests you suggest?

I think that's a good test. The Docker-based cluster is real enough. We can test it more after merging and before release. Thanks.

gianm
gianm approved these changes Nov 19, 2019
View reviewed changes
Copy link
Copy Markdown
Contributor

@gianm gianm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 after CI.

@gianm
Copy link
Copy Markdown
Contributor

gianm commented Nov 19, 2019

@ccaominh Could you please merge master one more time, #8902 was also needed.

@gianm gianm added this to the 0.17.0 milestone Nov 19, 2019
@gianm gianm added the Security label Nov 19, 2019
@gianm
Copy link
Copy Markdown
Contributor

gianm commented Nov 19, 2019

Thanks, looks good now!

@gianm gianm merged commit 8365bdf into apache:master Nov 19, 2019
@ccaominh ccaominh deleted the security-update-11-2019 branch November 19, 2019 17:46
jon-wei pushed a commit to jon-wei/druid that referenced this pull request Nov 26, 2019
@ccaominh @jon-wei
Address security vulnerabilities (apache#8878)
c37a2bc 
* Address security vulnerabilities

Security vulnerabilities addressed by upgrading 3rd party libs:

- Upgrade avro-ipc to 1.9.1
  - sonatype-2019-0115
- Upgrade caffeine to 2.8.0
  - sonatype-2019-0282
- Upgrade commons-beanutils to 1.9.4
  - CVE-2014-0114
- Upgrade commons-codec to 1.13
  - sonatype-2012-0050
- Upgrade commons-compress to 1.19
  - CVE-2019-12402
  - sonatype-2018-0293
- Upgrade hadoop-common to 2.8.5
  - CVE-2018-11767
- Upgrade hadoop-mapreduce-client-core to 2.8.5
  - CVE-2017-3166
- Upgrade hibernate-validator to 5.2.5
  - CVE-2017-7536
- Upgrade httpclient to 4.5.10
  - sonatype-2017-0359
- Upgrade icu4j to 55.1
  - CVE-2014-8147
- Upgrade jackson-databind to 2.6.7.3:
  - CVE-2017-7525
- Upgrade jetty-http to 9.4.12:
  - CVE-2017-7657
  - CVE-2017-7658
  - CVE-2017-7656
  - CVE-2018-12545
- Upgrade log4j-core to 2.8.2
  - CVE-2017-5645:
- Upgrade netty to 3.10.6
  - CVE-2015-2156
- Upgrade netty-common to 4.1.42
  - CVE-2019-9518
- Upgrade netty-codec-http to 4.1.42
  - CVE-2019-16869
- Upgrade nimbus-jose-jwt to 4.41.1
  - CVE-2017-12972
  - CVE-2017-12974
- Upgrade plexus-utils to 3.0.24
  - CVE-2017-1000487
  - sonatype-2015-0173
  - sonatype-2016-0398
- Upgrade postgresql to 42.2.8
  - CVE-2018-10936

Note that if users are using JDBC lookups with postgres, they may need
to update the JDBC jar used by the lookup extension.

* Fix license for postgresql
@ccaominh ccaominh mentioned this pull request Dec 6, 2019
Closed
@jon-wei jon-wei mentioned this pull request Dec 28, 2019
Closed
@ccaominh ccaominh mentioned this pull request Mar 10, 2020
Closed
@suneet-s suneet-s mentioned this pull request Mar 5, 2021
Closed
debasatwa29 pushed a commit to debasatwa29/druid that referenced this pull request Jun 2, 2022
Pull upstream to upgrade log4j to 2.15.0 to address security vulnerab…
5bea06b 
…ilities

Summary:
Druid is running with JVM 1.8.0_232 but log4j 2.5 so it's P1 rather than p0.

Pull upstream to upgrade log4j to 2.15.0 to address security vulnerabilities

Changes are from the following upstream PRs:

# Upgrade log4j from 2.8.2 to 2.15.0
apache#12051
apache#12056

# Upgrade log4j from 2.5 to 2.8.2
apache#8878

Reviewers: O1139 Druid, jgu, itallam

Reviewed By: O1139 Druid, jgu, itallam

Subscribers: jenkins, shawncao, #realtime-analytics

Differential Revision: https://phabricator.pinadmin.com/D823708
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gianm gianm gianm approved these changes

Assignees

No one assigned

Labels

Release Notes Security

Projects

None yet

Milestone

0.17.0

Development

Successfully merging this pull request may close these issues.

Upgrade jackson-databind to fix remote code exec vulnerability [security] jackson-databind dependency needs to be upgraded

5 participants

@ccaominh @gianm @jnaous @vogievetsky @jon-wei