[fix][sec] Suppress already covered CVE-2023-2976 in `clickhouse-jdbc-0.4.6-all.jar` and `canal.client-1.1.5.jar` #20792

JooHyukKim · 2023-07-12T11:37:03Z

Fixes workflows that fails with

Motivation

The OWASP dependency check failed. Link: https://github.com/apache/pulsar/actions/runs/5521854569/jobs/10090413638?pr=20782

Error:  Failed to execute goal org.owasp:dependency-check-maven:8.2.1:aggregate (default) on project pulsar: 
Error:  
Error:  One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0': 
Error:  
Error:  canal.client-1.1.5.jar/META-INF/maven/com.google.guava/guava/pom.xml: CVE-2023-2976(7.1)
Error:  clickhouse-jdbc-0.4.6-all.jar/META-INF/maven/com.google.guava/guava/pom.xml: CVE-2023-2976(7.1)
Error:  
Error:  See the dependency-check report for more details.
Error:  -> [Help 1]
Error:  
Error:  To see the full stack trace of the errors, re-run Maven with the -e switch.
Error:  Re-run Maven using the -X switch to enable full debug logging.
Error:  
Error:  For more information about the errors and possible solutions, please read the following articles:
Error:  [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
Error:  
Error:  After correcting the problems, you can resume the build with the command
Error:    mvn <args> -rf :pulsar

The PR already addressed #20699 the CVE-2023-2976. And Pulsar currently uses Guava 32.1.1 version

Modifications

Suppress warning

Documentation

doc
doc-required
doc-not-needed
doc-complete

Matching PR in forked repository

PR in forked repository: https://github.com/JooHyukKim/pulsar/pull/21

…-clickhouse

JooHyukKim · 2023-07-18T08:38:38Z

@tisonkun thank you for looking into this 🙏🏼

FYI, there is another one lined up for canal.client-1.1.5. jar (refer below photo).
I am getting this issue fixed one by one because depedency-related commits most often gets reverted and picked across versions.

JooHyukKim · 2023-07-18T08:39:36Z

@tisonkun Sorry, merged upstream/master and now CI is blocked agaiin 🥲

tisonkun · 2023-07-18T08:51:12Z

No sorry. You are doing things right :D

tisonkun

Comments inline. You may try to verified locally.

tisonkun · 2023-07-18T10:57:57Z

src/owasp-dependency-check-suppressions.xml

@@ -181,6 +181,16 @@
        <sha1>fa9a1ccda7d78edb51a3a33d3493566092786a30</sha1>
        <cve>CVE-2021-25263</cve>
    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        file name: clickhouse-jdbc-0.4.6-all.jar


Error: One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0': Error: Error: canal.client-1.1.5.jar/META-INF/maven/com.google.guava/guava/pom.xml: CVE-2023-2976(7.1) Error: clickhouse-jdbc-0.4.6-all.jar/META-INF/maven/com.google.guava/guava/pom.xml: CVE-2023-2976(7.1)

It seems this patch doesn't suppress the false positive.

Will check again, thanks ☺️🙏🏽

So currently canal client passes. but clickhouse doesn't.
What I can't seem to figure out why 🤔🤔🤔
Checksum I used.
https://repo1.maven.org/maven2/com/clickhouse/clickhouse-jdbc/0.4.6/clickhouse-jdbc-0.4.6-all.jar.sha1

@tisonkun May I ask you for another Github workflow trigger? Because while verifying this PR locally, OWASP check that I ran locally failed on

clickhouse-jdbc-0.4.6-all.jar and

canal.client-1.1.5.jar

yesterday, but today we are failing a bunch.

FYI, command used,

mvn -B -ntp verify -PskipDocker,skip-all,owasp-dependency-check -Dcheckstyle.skip=true -DskipTests -pl '!pulsar-sql,!distribution/server,!distribution/io,!distribution/offloaders,!pulsar-sql/presto-distribution,!tiered-storage/file-system,!pulsar-io/flume,!pulsar-io/hbase,!pulsar-io/hdfs2,!pulsar-io/hdfs3,!pulsar-io/docs,!pulsar-io/jdbc/openmldb'

[ERROR] [ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0': [ERROR] [ERROR] api-util-1.0.0-M20.jar: CVE-2018-1337(9.8) [ERROR] avro-1.8.2.jar/META-INF/maven/com.google.guava/guava/pom.xml: CVE-2023-2976(7.1) [ERROR] clickhouse-jdbc-0.4.6-all.jar/META-INF/maven/com.google.guava/guava/pom.xml: CVE-2023-2976(7.1) .... omitted some (JooHyukKim)

I'll trigger one. But generally you can test in your personal fork and that should be the same.

@tisonkun Right. I keep forgetting 🫣. Thank you still~

Phew, took longer than I thought, to figure out why still not worked.
Verified in : https://github.com/JooHyukKim/pulsar/pull/21

JooHyukKim · 2023-07-19T02:06:49Z

@lhotari May I ask if you intentionally triggered this action? Ran into it while debugging on this PR.

I am asking this because I assumed there might, or will be bigger fix that covers this PR also. In which case this PR can just be omitted.

JooHyukKim · 2023-07-19T02:28:52Z

/pulsarbot rerun-failure-checks

stale

tisonkun · 2023-07-19T02:44:12Z

/pulsarbot rerun-failure-checks

JooHyukKim · 2023-07-19T12:28:41Z

Note that current changes cover both clickhouse-jdbc-0.4.6-all.jar and canal.client-1.1.5.jar in one-go, for following reasons.

Both of the new suppressions handle the same CVE-2023-2976
If we do separate PRs, changes may be atomic. But downside is having to merge PRs with failed CI.

/cc @tisonkun 👍🏻

JooHyukKim · 2023-07-19T14:25:02Z

/pulsarbot rerun-failure-checks

…-clickhouse

JooHyukKim · 2023-07-20T06:05:46Z

Filed #20839 and it got fixed. No more blocker 👍🏻

tisonkun

Thank you!

tisonkun · 2023-07-20T10:24:44Z

Merging...

add suppression

cb451e4

github-actions bot added the doc-not-needed Your PR changes do not impact docs label Jul 12, 2023

Add more URL

3c4a7b9

JooHyukKim mentioned this pull request Jul 12, 2023

[refactor][cli][PIP-280] Create new pulsar-cli-utils module #20782

Merged

15 tasks

tisonkun requested a review from lhotari July 12, 2023 12:07

tisonkun approved these changes Jul 18, 2023

View reviewed changes

Merge remote-tracking branch 'upstream/master' into guava-false-alarm…

59f9a99

…-clickhouse

JooHyukKim requested a review from tisonkun July 18, 2023 08:38

tisonkun previously requested changes Jul 18, 2023

View reviewed changes

JooHyukKim marked this pull request as draft July 18, 2023 11:26

JooHyukKim changed the title ~~[fix][sec] Suppress already covered CVE-2023-2976 in clickhouse-jdbc-0.4.6-all.jar~~ [fix][sec] Suppress already covered CVE-2023-2976 in clickhouse-jdbc-0.4.6-all.jar and canal.client-1.1.5.jar Jul 18, 2023

JooHyukKim added 2 commits July 18, 2023 23:53

Fix mismatched checksu and add canal.client

a19fdfe

Update owasp-dependency-check-suppressions.xml

8311d30

JooHyukKim marked this pull request as ready for review July 19, 2023 02:23

tisonkun added the ready-to-test label Jul 19, 2023

Update owasp-dependency-check-suppressions.xml

af2a5f1

JooHyukKim requested a review from tisonkun July 19, 2023 12:24

JooHyukKim mentioned this pull request Jul 19, 2023

[Bug] CI Blocker Build Pulsar docker image failure #20839

Closed

2 tasks

Merge remote-tracking branch 'upstream/master' into guava-false-alarm…

016f489

…-clickhouse

tisonkun approved these changes Jul 20, 2023

View reviewed changes

tisonkun merged commit 514fa60 into apache:master Jul 20, 2023

JooHyukKim deleted the guava-false-alarm-clickhouse branch July 20, 2023 14:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[fix][sec] Suppress already covered CVE-2023-2976 in `clickhouse-jdbc-0.4.6-all.jar` and `canal.client-1.1.5.jar` #20792

[fix][sec] Suppress already covered CVE-2023-2976 in `clickhouse-jdbc-0.4.6-all.jar` and `canal.client-1.1.5.jar` #20792

JooHyukKim commented Jul 12, 2023 •

edited

Loading

JooHyukKim commented Jul 18, 2023

JooHyukKim commented Jul 18, 2023

tisonkun commented Jul 18, 2023

tisonkun left a comment

tisonkun Jul 18, 2023

JooHyukKim Jul 18, 2023

JooHyukKim Jul 18, 2023 •

edited

Loading

JooHyukKim Jul 19, 2023 •

edited

Loading

tisonkun Jul 19, 2023

JooHyukKim Jul 19, 2023

JooHyukKim Jul 19, 2023

JooHyukKim commented Jul 19, 2023 •

edited

Loading

JooHyukKim commented Jul 19, 2023

tisonkun commented Jul 19, 2023

JooHyukKim commented Jul 19, 2023

JooHyukKim commented Jul 19, 2023

JooHyukKim commented Jul 20, 2023

tisonkun left a comment

tisonkun commented Jul 20, 2023

[fix][sec] Suppress already covered CVE-2023-2976 in clickhouse-jdbc-0.4.6-all.jar and canal.client-1.1.5.jar #20792

[fix][sec] Suppress already covered CVE-2023-2976 in clickhouse-jdbc-0.4.6-all.jar and canal.client-1.1.5.jar #20792

Conversation

JooHyukKim commented Jul 12, 2023 • edited Loading

Motivation

Modifications

Documentation

Matching PR in forked repository

JooHyukKim commented Jul 18, 2023

JooHyukKim commented Jul 18, 2023

tisonkun commented Jul 18, 2023

tisonkun left a comment

Choose a reason for hiding this comment

tisonkun Jul 18, 2023

Choose a reason for hiding this comment

JooHyukKim Jul 18, 2023

Choose a reason for hiding this comment

JooHyukKim Jul 18, 2023 • edited Loading

Choose a reason for hiding this comment

JooHyukKim Jul 19, 2023 • edited Loading

Choose a reason for hiding this comment

tisonkun Jul 19, 2023

Choose a reason for hiding this comment

JooHyukKim Jul 19, 2023

Choose a reason for hiding this comment

JooHyukKim Jul 19, 2023

Choose a reason for hiding this comment

JooHyukKim commented Jul 19, 2023 • edited Loading

JooHyukKim commented Jul 19, 2023

tisonkun commented Jul 19, 2023

JooHyukKim commented Jul 19, 2023

JooHyukKim commented Jul 19, 2023

JooHyukKim commented Jul 20, 2023

tisonkun left a comment

Choose a reason for hiding this comment

tisonkun commented Jul 20, 2023

[fix][sec] Suppress already covered CVE-2023-2976 in `clickhouse-jdbc-0.4.6-all.jar` and `canal.client-1.1.5.jar` #20792

[fix][sec] Suppress already covered CVE-2023-2976 in `clickhouse-jdbc-0.4.6-all.jar` and `canal.client-1.1.5.jar` #20792

JooHyukKim commented Jul 12, 2023 •

edited

Loading

JooHyukKim Jul 18, 2023 •

edited

Loading

JooHyukKim Jul 19, 2023 •

edited

Loading

JooHyukKim commented Jul 19, 2023 •

edited

Loading