Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Backport 2.8] Resolve CVE-2023-2976 by forcing use of Guava 32.0.1 (#2937) #2975

Closed
wants to merge 3 commits into from
Closed

[Backport 2.8] Resolve CVE-2023-2976 by forcing use of Guava 32.0.1 (#2937) #2975

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2b98043
Force 32... (#2937)
stephen-crawford Jul 6, 2023
3c436a3
Resolve bunch of dependency CVEs
DarshitChanpura Jul 10, 2023
3393155
Fixes build.gradle
DarshitChanpura Jul 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 17 additions & 5 deletions build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -285,17 +285,20 @@ configurations.all {
force "io.netty:netty-transport:${versions.netty}"
force "io.netty:netty-transport-native-unix-common:${versions.netty}"
force "org.apache.bcel:bcel:6.6.0" // This line should be removed once Spotbugs is upgraded to 4.7.4
force "com.github.luben:zstd-jni:${versions.zstd}"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could not resolve com.github.luben:zstd-jni:null.

Copy link
Collaborator

@willyborankin willyborankin Jul 11, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmmm I think for 2.x it needs to be 1.5.5-3. Since versions.zstd comes with 2.9 version. So after 2.9 has been released we can use it in 2.x or I'm missing something

Copy link
Collaborator

@willyborankin willyborankin Jul 13, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, sorry for the misleading comment. I did not notice that it is for 2.8 version. The version of ZSTD should stay the same in this case.
ZSTD 1.5.5-3 was merged in OS main branch and I hope will be released in 2.9 and before that sec plugin uses its own. To avoid regressions lets leave it as is.

force "org.xerial.snappy:snappy-java:1.1.10.1"
force 'com.google.guava:guava:32.0.1-jre'
}
}

dependencies {
implementation 'jakarta.annotation:jakarta.annotation-api:1.3.5'
implementation "org.opensearch.plugin:transport-netty4-client:${opensearch_version}"
implementation "org.opensearch.client:opensearch-rest-high-level-client:${opensearch_version}"
implementation 'com.google.guava:guava:30.0-jre'
implementation 'com.google.guava:guava:32.0.1-jre'
implementation 'org.greenrobot:eventbus:3.2.0'
implementation 'commons-cli:commons-cli:1.3.1'
implementation 'org.bouncycastle:bcprov-jdk15on:1.67'
implementation 'commons-cli:commons-cli:1.5.0'
implementation "org.bouncycastle:bcprov-jdk15to18:${versions.bouncycastle}"
implementation 'org.ldaptive:ldaptive:1.2.3'
implementation 'org.apache.httpcomponents:httpclient-cache:4.5.13'
implementation 'io.jsonwebtoken:jjwt-api:0.10.8'
Expand Down Expand Up @@ -366,9 +369,10 @@ dependencies {
runtimeOnly 'com.fasterxml.woodstox:woodstox-core:6.4.0'
runtimeOnly 'org.apache.ws.xmlschema:xmlschema-core:2.2.5'
runtimeOnly 'org.apache.santuario:xmlsec:2.2.3'
runtimeOnly 'com.github.luben:zstd-jni:1.5.2-1'
runtimeOnly "com.github.luben:zstd-jni:${versions.zstd}"
runtimeOnly 'org.checkerframework:checker-qual:3.5.0'
runtimeOnly "org.bouncycastle:bcpkix-jdk15on:${versions.bouncycastle}"
runtimeOnly "org.bouncycastle:bcpkix-jdk15to18:${versions.bouncycastle}"
runtimeOnly 'org.scala-lang.modules:scala-java8-compat_3:1.0.2'


implementation 'org.apache.commons:commons-lang3:3.4'
Expand Down Expand Up @@ -418,6 +422,14 @@ dependencies {
implementation "com.fasterxml.jackson.core:jackson-databind:${versions.jackson_databind}"

compileOnly "org.opensearch:opensearch:${opensearch_version}"

//Checkstyle
checkstyle 'com.puppycrawl.tools:checkstyle:10.12.1'

//spotless
implementation('com.google.googlejavaformat:google-java-format:1.17.0') {
exclude group: 'com.google.guava'
}
}

jar {
Expand Down