Github-Mirror/seaweedfs
1
0
Fork 0
mirror of https://github.com/seaweedfs/seaweedfs.git synced 2026-09-10 08:30:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

security: add dependencyManagement to fix vulnerable transitives

Browse Source 
- Pin Jackson to 2.15.3 (fixes multiple CVEs in older versions)
- Pin Netty to 4.1.100.Final (fixes CVEs in transport/codec)
- Pin Apache Avro to 1.11.4 (fixes deserialization CVEs)
- Pin Apache ZooKeeper to 3.9.1 (fixes authentication bypass)
- Pin commons-compress to 1.26.0 (fixes zip slip vulnerabilities)
- Pin commons-io to 2.15.1 (fixes path traversal)
- Pin Guava to 32.1.3-jre (fixes temp directory vulnerabilities)
- Pin SnakeYAML to 2.2 (fixes arbitrary code execution)
- Pin Jetty to 9.4.53 (fixes multiple HTTP vulnerabilities)
- Overrides vulnerable versions from Spark/Hadoop transitives
This commit is contained in:
chrislu
2025-11-22 14:05:24 -08:00
parent 9e8b8276ea
commit 7b548be48e
1 changed files with 128 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/java/spark/pom.xml
+128
View File
@@ -20,8 +20,136 @@
<hadoop.version>3.3.6</hadoop.version>
<scala.binary.version>2.12</scala.binary.version>
<junit.version>4.13.2</junit.version>
<jackson.version>2.15.3</jackson.version>
<netty.version>4.1.100.Final</netty.version>
</properties>
<!-- Override vulnerable transitive dependencies -->
<dependencyManagement>
<dependencies>
<!-- Jackson - Fix CVEs in older versions -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>${jackson.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
<version>${jackson.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-annotations</artifactId>
<version>${jackson.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-yaml</artifactId>
<version>${jackson.version}</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.module</groupId>
<artifactId>jackson-module-scala_${scala.binary.version}</artifactId>
<version>${jackson.version}</version>
</dependency>
<!-- Netty - Fix CVEs in older versions -->
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-all</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-handler</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-transport</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-transport-native-epoll</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-http</artifactId>
<version>${netty.version}</version>
</dependency>
<dependency>
<groupId>io.netty</groupId>
<artifactId>netty-codec-http2</artifactId>
<version>${netty.version}</version>
</dependency>
<!-- Apache Avro - Fix CVEs -->
<dependency>
<groupId>org.apache.avro</groupId>
<artifactId>avro</artifactId>
<version>1.11.4</version>
</dependency>
<!-- Apache ZooKeeper - Fix CVEs -->
<dependency>
<groupId>org.apache.zookeeper</groupId>
<artifactId>zookeeper</artifactId>
<version>3.9.1</version>
</dependency>
<!-- Apache Commons - Fix CVEs -->
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-compress</artifactId>
<version>1.26.0</version>
</dependency>
<dependency>
<groupId>commons-io</groupId>
<artifactId>commons-io</artifactId>
<version>2.15.1</version>
</dependency>
<!-- Guava - Fix CVEs -->
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>32.1.3-jre</version>
</dependency>
<!-- SnakeYAML - Fix CVEs -->
<dependency>
<groupId>org.yaml</groupId>
<artifactId>snakeyaml</artifactId>
<version>2.2</version>
</dependency>
<!-- Jetty - Fix CVEs -->
<dependency>
<groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-server</artifactId>
<version>9.4.53.v20231009</version>
</dependency>
<dependency>
<groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-http</artifactId>
<version>9.4.53.v20231009</version>
</dependency>
<dependency>
<groupId>org.eclipse.jetty</groupId>
<artifactId>jetty-servlet</artifactId>
<version>9.4.53.v20231009</version>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<!-- Spark Core -->
<dependency>