[fix][sec] Suppress already covered CVE-2023-2976 in `clickhouse-jdbc-0.4.6-all.jar` and `canal.client-1.1.5.jar` by JooHyukKim · Pull Request #20792 · apache/pulsar

JooHyukKim · 2023-07-12T11:37:03Z

Fixes workflows that fails with

Motivation

The OWASP dependency check failed. Link: https://github.com/apache/pulsar/actions/runs/5521854569/jobs/10090413638?pr=20782

Error:  Failed to execute goal org.owasp:dependency-check-maven:8.2.1:aggregate (default) on project pulsar: 
Error:  
Error:  One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0': 
Error:  
Error:  canal.client-1.1.5.jar/META-INF/maven/com.google.guava/guava/pom.xml: CVE-2023-2976(7.1)
Error:  clickhouse-jdbc-0.4.6-all.jar/META-INF/maven/com.google.guava/guava/pom.xml: CVE-2023-2976(7.1)
Error:  
Error:  See the dependency-check report for more details.
Error:  -> [Help 1]
Error:  
Error:  To see the full stack trace of the errors, re-run Maven with the -e switch.
Error:  Re-run Maven using the -X switch to enable full debug logging.
Error:  
Error:  For more information about the errors and possible solutions, please read the following articles:
Error:  [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
Error:  
Error:  After correcting the problems, you can resume the build with the command
Error:    mvn <args> -rf :pulsar

The PR already addressed #20699 the CVE-2023-2976. And Pulsar currently uses Guava 32.1.1 version

Modifications

Suppress warning

Documentation

doc
doc-required
doc-not-needed
doc-complete

Matching PR in forked repository

PR in forked repository: https://github.com/JooHyukKim/pulsar/pull/21

…-clickhouse

JooHyukKim · 2023-07-18T08:38:38Z

@tisonkun thank you for looking into this 🙏🏼

FYI, there is another one lined up for canal.client-1.1.5. jar (refer below photo).
I am getting this issue fixed one by one because depedency-related commits most often gets reverted and picked across versions.

JooHyukKim · 2023-07-18T08:39:36Z

@tisonkun Sorry, merged upstream/master and now CI is blocked agaiin 🥲

tisonkun · 2023-07-18T08:51:12Z

No sorry. You are doing things right :D

tisonkun

Comments inline. You may try to verified locally.

tisonkun · 2023-07-18T10:57:57Z

    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        file name: clickhouse-jdbc-0.4.6-all.jar


Error: One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0': Error: Error: canal.client-1.1.5.jar/META-INF/maven/com.google.guava/guava/pom.xml: CVE-2023-2976(7.1) Error: clickhouse-jdbc-0.4.6-all.jar/META-INF/maven/com.google.guava/guava/pom.xml: CVE-2023-2976(7.1)

It seems this patch doesn't suppress the false positive.

Will check again, thanks ☺️🙏🏽

So currently canal client passes. but clickhouse doesn't.
What I can't seem to figure out why 🤔🤔🤔
Checksum I used.
https://repo1.maven.org/maven2/com/clickhouse/clickhouse-jdbc/0.4.6/clickhouse-jdbc-0.4.6-all.jar.sha1

@tisonkun May I ask you for another Github workflow trigger? Because while verifying this PR locally, OWASP check that I ran locally failed on

clickhouse-jdbc-0.4.6-all.jar and

canal.client-1.1.5.jar

yesterday, but today we are failing a bunch.

FYI, command used,

mvn -B -ntp verify -PskipDocker,skip-all,owasp-dependency-check -Dcheckstyle.skip=true -DskipTests -pl '!pulsar-sql,!distribution/server,!distribution/io,!distribution/offloaders,!pulsar-sql/presto-distribution,!tiered-storage/file-system,!pulsar-io/flume,!pulsar-io/hbase,!pulsar-io/hdfs2,!pulsar-io/hdfs3,!pulsar-io/docs,!pulsar-io/jdbc/openmldb'

[ERROR] [ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0': [ERROR] [ERROR] api-util-1.0.0-M20.jar: CVE-2018-1337(9.8) [ERROR] avro-1.8.2.jar/META-INF/maven/com.google.guava/guava/pom.xml: CVE-2023-2976(7.1) [ERROR] clickhouse-jdbc-0.4.6-all.jar/META-INF/maven/com.google.guava/guava/pom.xml: CVE-2023-2976(7.1) .... omitted some (JooHyukKim)

I'll trigger one. But generally you can test in your personal fork and that should be the same.

@tisonkun Right. I keep forgetting 🫣. Thank you still~

Phew, took longer than I thought, to figure out why still not worked.
Verified in : https://github.com/JooHyukKim/pulsar/pull/21

JooHyukKim · 2023-07-19T02:06:49Z

@lhotari May I ask if you intentionally triggered this action? Ran into it while debugging on this PR.

I am asking this because I assumed there might, or will be bigger fix that covers this PR also. In which case this PR can just be omitted.

JooHyukKim · 2023-07-19T02:28:52Z

/pulsarbot rerun-failure-checks

stale

tisonkun · 2023-07-19T02:44:12Z

/pulsarbot rerun-failure-checks

JooHyukKim · 2023-07-19T12:28:41Z

Note that current changes cover both clickhouse-jdbc-0.4.6-all.jar and canal.client-1.1.5.jar in one-go, for following reasons.

Both of the new suppressions handle the same CVE-2023-2976
If we do separate PRs, changes may be atomic. But downside is having to merge PRs with failed CI.

/cc @tisonkun 👍🏻

JooHyukKim · 2023-07-19T14:25:02Z

/pulsarbot rerun-failure-checks

…-clickhouse

JooHyukKim · 2023-07-20T06:05:46Z

Filed #20839 and it got fixed. No more blocker 👍🏻

tisonkun

Thank you!

tisonkun · 2023-07-20T10:24:44Z

Merging...

add suppression

cb451e4

github-actions Bot added the doc-not-needed Your PR changes do not impact docs label Jul 12, 2023

Add more URL

3c4a7b9

JooHyukKim mentioned this pull request Jul 12, 2023

[refactor][cli][PIP-280] Create new pulsar-cli-utils module #20782

Merged

15 tasks

tisonkun requested a review from lhotari July 12, 2023 12:07

tisonkun approved these changes Jul 18, 2023

View reviewed changes

Merge remote-tracking branch 'upstream/master' into guava-false-alarm…

59f9a99

…-clickhouse

JooHyukKim requested a review from tisonkun July 18, 2023 08:38

tisonkun previously requested changes Jul 18, 2023

View reviewed changes

JooHyukKim marked this pull request as draft July 18, 2023 11:26

JooHyukKim changed the title ~~[fix][sec] Suppress already covered CVE-2023-2976 in clickhouse-jdbc-0.4.6-all.jar~~ [fix][sec] Suppress already covered CVE-2023-2976 in clickhouse-jdbc-0.4.6-all.jar and canal.client-1.1.5.jar Jul 18, 2023

JooHyukKim added 2 commits July 18, 2023 23:53

Fix mismatched checksu and add canal.client

a19fdfe

Update owasp-dependency-check-suppressions.xml

8311d30

JooHyukKim marked this pull request as ready for review July 19, 2023 02:23

tisonkun added the ready-to-test label Jul 19, 2023

Update owasp-dependency-check-suppressions.xml

af2a5f1

JooHyukKim requested a review from tisonkun July 19, 2023 12:24

JooHyukKim mentioned this pull request Jul 19, 2023

[Bug] CI Blocker Build Pulsar docker image failure #20839

Closed

2 tasks

Merge remote-tracking branch 'upstream/master' into guava-false-alarm…

016f489

…-clickhouse

tisonkun approved these changes Jul 20, 2023

View reviewed changes

tisonkun merged commit 514fa60 into apache:master Jul 20, 2023

JooHyukKim deleted the guava-false-alarm-clickhouse branch July 20, 2023 14:12

Uh oh!

Conversation

JooHyukKim commented Jul 12, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Modifications

Documentation

Matching PR in forked repository

Uh oh!

JooHyukKim commented Jul 18, 2023

Uh oh!

JooHyukKim commented Jul 18, 2023

Uh oh!

tisonkun commented Jul 18, 2023

Uh oh!

tisonkun left a comment

Choose a reason for hiding this comment

Uh oh!

tisonkun Jul 18, 2023

Choose a reason for hiding this comment

Uh oh!

JooHyukKim Jul 18, 2023

Choose a reason for hiding this comment

Uh oh!

JooHyukKim Jul 18, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JooHyukKim Jul 19, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tisonkun Jul 19, 2023

Choose a reason for hiding this comment

Uh oh!

JooHyukKim Jul 19, 2023

Choose a reason for hiding this comment

Uh oh!

JooHyukKim Jul 19, 2023

Choose a reason for hiding this comment

Uh oh!

JooHyukKim commented Jul 19, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JooHyukKim commented Jul 19, 2023

Uh oh!

tisonkun commented Jul 19, 2023

Uh oh!

JooHyukKim commented Jul 19, 2023

Uh oh!

JooHyukKim commented Jul 19, 2023

Uh oh!

JooHyukKim commented Jul 20, 2023

Uh oh!

tisonkun left a comment

Choose a reason for hiding this comment

Uh oh!

tisonkun commented Jul 20, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

JooHyukKim commented Jul 12, 2023 •

edited

Loading

JooHyukKim Jul 18, 2023 •

edited

Loading

JooHyukKim Jul 19, 2023 •

edited

Loading

JooHyukKim commented Jul 19, 2023 •

edited

Loading