Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVEs fix #107

Merged
merged 7 commits into from
Jun 3, 2024
Merged

CVEs fix #107

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
0fcfe8b
PK upgrade
Shmuma Jun 3, 2024
60abdae
Pin aircompressor
Shmuma Jun 3, 2024
31caa3c
Exclude bouncycastle CVEs, fix janino dep
Shmuma Jun 3, 2024
8ed0ea6
PK fix
Shmuma Jun 3, 2024
9fe3348
Refs unification
Shmuma Jun 3, 2024
0f7c6b3
Fix CVEs
Shmuma Jun 3, 2024
e9c3f74
Upgrade PK
Shmuma Jun 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/workflows/broken_links_checker.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 1 addition & 2 deletions .github/workflows/ci-build.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

14 changes: 5 additions & 9 deletions .github/workflows/dependencies_update.yml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

217 changes: 113 additions & 104 deletions dependencies.md
View file
Open in desktop

Large diffs are not rendered by default.

1 change: 1 addition & 0 deletions doc/changes/changelog.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

29 changes: 29 additions & 0 deletions doc/changes/changes_2.1.6.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
# Exasol AWS Glue Connector 2.1.6, released 2024-06-03

Code name: CVEs fixes

## Summary
Fixed CVE-2024-36114 in io.airlift:aircompressor (dependency of spark-sql).
Fixed CVE-2023-33546 in org.codehaus.janino:janino:jar:3.1.9 (previously excluded).
Fixed CVE-2023-52428 in com.nimbusds:nimbus-jose-jwt:jar:9.8.1 (previously excluded).
Bunch of CVEs in org.bouncycastle:bcprov-jdk15on were excluded.

## Features

* #106: CVE-2024-36114: io.airlift:aircompressor:jar:0.25:provided
* #100: CVE-2023-33201: org.bouncycastle:bcprov-jdk15on:jar:1.70:provided
* #101: CVE-2023-33202: org.bouncycastle:bcprov-jdk15on:jar:1.70:provided
* #102: CVE-2024-29857: org.bouncycastle:bcprov-jdk15on:jar:1.70:provided
* #103: CVE-2024-30171: org.bouncycastle:bcprov-jdk15on:jar:1.70:provided
* #104: CVE-2024-34447: org.bouncycastle:bcprov-jdk15on:jar:1.70:provided

## Dependency Updates

### Plugin Dependency Updates

* Updated `com.exasol:error-code-crawler-maven-plugin:2.0.2` to `2.0.3`
* Updated `com.exasol:project-keeper-maven-plugin:4.3.0` to `4.3.2`
* Updated `org.apache.maven.plugins:maven-enforcer-plugin:3.4.1` to `3.5.0`
* Updated `org.apache.maven.plugins:maven-jar-plugin:3.3.0` to `3.4.1`
* Updated `org.apache.maven.plugins:maven-toolchains-plugin:3.1.0` to `3.2.0`
* Updated `org.sonarsource.scanner.maven:sonar-maven-plugin:3.11.0.3922` to `4.0.0.4121`
4 changes: 2 additions & 2 deletions doc/developers_guide/developers_guide.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,11 +40,11 @@ To test connector by creating a custom connector, please follow these steps.

### Creating an Assembly Jar

By running `mvn verify` or `mvn package` create a connector artifact. For example, `target/exasol-glue-connector-2.1.5-assembly.jar`.
By running `mvn verify` or `mvn package` create a connector artifact. For example, `target/exasol-glue-connector-2.1.6-assembly.jar`.

### Uploading the Artifact to S3 Bucket

Upload the JAR artifact from previous step into an S3 bucket. For instance, `s3://exasol-artifacts/glue-connector/exasol-glue-connector-2.1.5-assembly.jar`.
Upload the JAR artifact from previous step into an S3 bucket. For instance, `s3://exasol-artifacts/glue-connector/exasol-glue-connector-2.1.6-assembly.jar`.

### Creating a Glue Studio Custom Connector

Expand Down
12 changes: 6 additions & 6 deletions pk_generated_parent.pom
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

73 changes: 50 additions & 23 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,14 @@
<modelVersion>4.0.0</modelVersion>
<groupId>com.exasol</groupId>
<artifactId>glue-connector</artifactId>
<version>2.1.5</version>
<version>2.1.6</version>
<name>Exasol AWS Glue Connector</name>
<description>An AWS Glue connector for accessing Exasol database</description>
<url>https://github.com/exasol/glue-connector/</url>
<parent>
<artifactId>glue-connector-generated-parent</artifactId>
<groupId>com.exasol</groupId>
<version>2.1.5</version>
<version>2.1.6</version>
<relativePath>pk_generated_parent.pom</relativePath>
</parent>
<properties>
Expand Down Expand Up @@ -103,6 +103,10 @@
<groupId>org.slf4j</groupId>
<artifactId>jcl-over-slf4j</artifactId>
</exclusion>
<exclusion>
<groupId>io.airlift</groupId>
<artifactId>aircompressor</artifactId>
</exclusion>
</exclusions>
</dependency>
<!-- Override version 3.6.3 of transitive dependency via org.apache.spark:spark-sql_2.12
Expand Down Expand Up @@ -195,6 +199,18 @@
<groupId>org.slf4j</groupId>
<artifactId>slf4j-reload4j</artifactId>
</exclusion>
<exclusion>
<groupId>org.codehaus.janino</groupId>
<artifactId>janino</artifactId>
</exclusion>
<exclusion>
<groupId>org.codehaus.janino</groupId>
<artifactId>commons-compiler</artifactId>
</exclusion>
<exclusion>
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -204,6 +220,32 @@
<version>2.10.1</version>
<scope>provided</scope>
</dependency>
<dependency>
<!-- Fix CVE-2024-36114 in transitive dependency of spark-sql -->
<groupId>io.airlift</groupId>
<artifactId>aircompressor</artifactId>
<version>0.27</version>
<scope>provided</scope>
</dependency>
<dependency>
<!-- Fix CVE-2023-52428 in transitive dependency of hadoop-client -->
<groupId>com.nimbusds</groupId>
<artifactId>nimbus-jose-jwt</artifactId>
<version>9.39.3</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.codehaus.janino</groupId>
<artifactId>janino</artifactId>
<version>3.1.12</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.codehaus.janino</groupId>
<artifactId>commons-compiler</artifactId>
<version>3.1.12</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.apache.hadoop</groupId>
<artifactId>hadoop-aws</artifactId>
Expand Down Expand Up @@ -374,10 +416,6 @@
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-ext-jdk15on</artifactId>
</exclusion>
<exclusion>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk15on</artifactId>
</exclusion>
<exclusion>
<groupId>org.codehaus.jackson</groupId>
<artifactId>*</artifactId>
Expand Down Expand Up @@ -498,7 +536,7 @@
<plugin>
<groupId>com.exasol</groupId>
<artifactId>project-keeper-maven-plugin</artifactId>
<version>4.3.0</version>
<version>4.3.2</version>
<executions>
<execution>
<goals>
Expand Down Expand Up @@ -639,29 +677,18 @@
<configuration>
<skip>${ossindex.skip}</skip>
<excludeVulnerabilityIds>
<!-- Ignore vulnerability reported for transitive
dependency org.codehaus.janino:janino:jar:3.1.9
via org.apache.spark:spark-sql_2.12 Please note:
janino is not included in the released artifact,
but 'provided' by the runtime Spark cluster.
-->
<exclude>CVE-2023-33546</exclude>
<!-- Ignore vulnerability reported for transitive
dependency com.nimbusds:nimbus-jose-jwt:jar:9.8.1
via org.apache.hadoop:hadoop-client:jar:3.3.6
Please note: nimbus-jose-jwt is not included in
the released artifact, but 'provided' by the
runtime Spark cluster.
-->
<exclude>CVE-2023-52428</exclude>

<!-- Ignore vulnerabilities from org.bouncycastle:bcprov-jdk15on:jar:1.70:provided via org.apache.hadoop:hadoop-client.
This is a "provided" library that is not included in the built JAR and must be fixed in the runtime environment. -->
<exclude>CVE-2023-33201</exclude>
<exclude>CVE-2023-33202</exclude>
<exclude>CVE-2024-29857</exclude>
<exclude>CVE-2024-30171</exclude>
<exclude>CVE-2024-30172</exclude>
<exclude>CVE-2023-33201</exclude>
<exclude>CVE-2023-33202</exclude>
<exclude>CVE-2024-29857</exclude>
<exclude>CVE-2024-30171</exclude>
<exclude>CVE-2024-34447</exclude>
</excludeVulnerabilityIds>
</configuration>
</plugin>
Expand Down
3 changes: 0 additions & 3 deletions release_config.yml
View file
Open in desktop

This file was deleted.

Loading