Skip to content

branch-4.1: [fix](fe) Upgrade vulnerable dependencies #67148

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
CalvinKirs wants to merge 2 commits into
base: branch-4.1
Choose a base branch
from
+112 −9
Open

branch-4.1: [fix](fe) Upgrade vulnerable dependencies #67148

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9d7b4da
[fix](fe) Replace vulnerable Bouncy Castle provider
CalvinKirs Aug 20, 2026
9803867
[fix](fe) Upgrade vulnerable dependencies
CalvinKirs Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions fe/fe-core/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -372,6 +372,12 @@ under the License.
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-jetty</artifactId>
</dependency>
<!-- Jetty 12.0.38 calls Jakarta Servlet 6.1 APIs when writing Set-Cookie headers. -->
<dependency>
<groupId>jakarta.servlet</groupId>
<artifactId>jakarta.servlet-api</artifactId>
<version>${jakarta.servlet-api.version}</version>
</dependency>
<!-- File Upload -->
<dependency>
<groupId>commons-fileupload</groupId>
Expand Down Expand Up @@ -420,6 +426,10 @@ under the License.
<groupId>com.huaweicloud.sdk</groupId>
<artifactId>huaweicloud-sdk-iam</artifactId>
<exclusions>
<exclusion>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk15on</artifactId>
</exclusion>
<exclusion>
<groupId>com.squareup.okhttp3</groupId>
<artifactId>okhttp</artifactId>
Expand All @@ -430,6 +440,12 @@ under the License.
</exclusion>
</exclusions>
</dependency>
<!-- Replace Huawei IAM's bcprov-jdk15on 1.69/1.70 with 1.84 from the maintained
jdk18on line; it fixes CVE-2023-33202 and the later 2025/2026 BC Java advisories. -->
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk18on</artifactId>
</dependency>
<!-- ICU4J for unicode normalization -->
<dependency>
<groupId>com.ibm.icu</groupId>
Expand Down
1 change: 0 additions & 1 deletion fe/hive-udf/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,6 @@ under the License.
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-shade-plugin</artifactId>
<version>3.6.0</version>
<configuration>
<minimizeJar>true</minimizeJar>
<relocations>
Expand Down
104 changes: 96 additions & 8 deletions fe/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,6 +205,11 @@ under the License.
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-shade-plugin</artifactId>
<version>${maven-shade-plugin.version}</version>
</plugin>
</plugins>
</pluginManagement>
<extensions>
Expand Down Expand Up @@ -267,9 +272,16 @@ under the License.
<commons-validator.version>1.9.0</commons-validator.version>
<gson.version>2.10.1</gson.version>
<guava.version>33.2.1-jre</guava.version>
<jackson.version>2.16.0</jackson.version>
<!-- Jackson 2.16.0 is affected by multiple 2026 parser and polymorphic-deserialization
vulnerabilities, including CVE-2026-54512. Version 2.21.5 contains the complete fixes. -->
<jackson.version>2.21.5</jackson.version>
<javassist.version>3.18.2-GA</javassist.version>
<javax.servlet-api.version>3.1.0</javax.servlet-api.version>
<!-- Jetty 12.0.38 (jetty-ee10-servlet) invokes jakarta.servlet.http.Cookie#getAttributes(),
which only exists since Jakarta Servlet 6.1. Pin the API to 6.1.0 so it matches the
jetty version; otherwise the transitive 6.0.0 from spring-boot triggers NoSuchMethodError
when the FE HTTP server writes a Set-Cookie (SameSite) header. -->
<jakarta.servlet-api.version>6.1.0</jakarta.servlet-api.version>
<je.version>18.3.14-doris-SNAPSHOT</je.version>
<jmockit.version>1.49</jmockit.version>
<commons-io.version>2.18.0</commons-io.version>
Expand All @@ -287,6 +299,9 @@ under the License.
<resilience4j.version>2.4.0</resilience4j.version>
<!-- Keep Netty compatible with Arrow Flight SQL 19 and other transitive Netty users. -->
<netty-all.version>4.2.15.Final</netty-all.version>
<!-- OpenTelemetry versions before 1.62.0 allow unbounded allocation while parsing W3C
baggage (CVE-2026-45292); align the complete OpenTelemetry graph on the fixed BOM. -->
<opentelemetry.version>1.62.0</opentelemetry.version>
<!--The dependence of transitive dependence cannot be ruled out, only Saving the nation through twisted ways.-->
<netty-3-test.version>3.10.6.Final</netty-3-test.version>
<objenesis.version>2.1</objenesis.version>
Expand Down Expand Up @@ -355,6 +370,11 @@ under the License.
<hamcrest.version>2.1</hamcrest.version>
<httpclient.version>4.5.13</httpclient.version>
<httpcore.version>4.4.15</httpcore.version>
<!-- HttpClient 5.5.2 can leak pooled connections on decode errors (CVE-2026-64607),
and HttpCore 5.3.6 is affected by HTTP/1 and HTTP/2 memory-exhaustion issues
(CVE-2026-54399 and CVE-2026-54428). Use their fixed maintenance releases. -->
<httpclient5.version>5.6.3</httpclient5.version>
<httpcore5.version>5.4.3</httpcore5.version>
<aws-java-sdk.version>1.12.669</aws-java-sdk.version>
<mariadb-java-client.version>3.0.9</mariadb-java-client.version>
<postgresql.version>42.7.13</postgresql.version>
Expand All @@ -368,18 +388,32 @@ under the License.
<antlr4.version>4.13.1</antlr4.version>
<joda.version>2.8.1</joda.version>
<project.scm.id>github</project.scm.id>
<spring.version>3.5.14</spring.version>
<spring-framework.version>6.2.18</spring-framework.version>
<!-- Spring Boot 3.5.16 manages fixed Spring LDAP 3.3.8, Spring Data 3.5.13,
Micrometer 1.15.12, and Logback 1.5.34 releases for their 2026 advisories. -->
<spring.version>3.5.16</spring.version>
<!-- Spring Framework 6.2.19 fixes the June 2026 security advisory set, including
CVE-2026-41848; keep the explicit framework BOM aligned with that release. -->
<spring-framework.version>6.2.19</spring-framework.version>
<orc.version>1.8.4</orc.version>
<zookeeper.version>3.9.3</zookeeper.version>
<velocity-engine-core.version>2.4</velocity-engine-core.version>
<ranger-plugins-common.version>2.8.0</ranger-plugins-common.version>
<bcprov-jdk15on.version>1.70</bcprov-jdk15on.version>
<!-- Huawei IAM pulls bcprov-jdk15on 1.69, whose final 1.70 release is vulnerable to
CVE-2023-33202. Use the compatible jdk18on line at 1.84, which also fixes
CVE-2025-14813, CVE-2026-0636, CVE-2026-3505, CVE-2026-5588, and CVE-2026-5598. -->
<bcprov-jdk18on.version>1.84</bcprov-jdk18on.version>
<woodstox.version>6.5.1</woodstox.version>
<kerby.version>2.0.3</kerby.version>
<jettison.version>1.5.4</jettison.version>
<jetty.version>12.0.29</jetty.version>
<!-- Jetty 12.0.34 is affected by CVE-2026-6790, CVE-2026-8384,
CVE-2026-10050, and CVE-2026-10051; 12.0.38 contains all published fixes. -->
<jetty.version>12.0.38</jetty.version>
<jetty-http.version>11.0.26</jetty-http.version>
<!-- org.lz4:lz4-java is archived and vulnerable through its final 1.8.x line.
Resolve its official 1.8.1 relocation POM, then manage the maintained coordinate at
1.11.1 to fix CVE-2025-12183, CVE-2025-66566, and CVE-2026-59949. -->
<lz4-java-relocation.version>1.8.1</lz4-java-relocation.version>
<lz4-java.version>1.11.1</lz4-java.version>
<immutables.version>2.9.3</immutables.version>
<ivy.version>2.5.2</ivy.version>
<icu4j.version>78.1</icu4j.version>
Expand All @@ -394,6 +428,10 @@ under the License.
<arrow.vector.classifier>shade-format-flatbuffers</arrow.vector.classifier>
<flatbuffers.version>1.12.0</flatbuffers.version>
<jacoco.version>0.8.10</jacoco.version>
<!-- Maven Shade 3.4.1 cannot parse the Java 21 multi-release classes shipped by
Jackson 2.21.x. Version 3.6.2 uses a current ASM release that supports them. -->
<maven-shade-plugin.version>3.6.2</maven-shade-plugin.version>
<argLine></argLine>
<trino.version>435</trino.version>
<nimbusds.version>10.0.1</nimbusds.version>
<jakarta.annotation-api.version>2.1.1</jakarta.annotation-api.version>
Expand Down Expand Up @@ -461,13 +499,48 @@ under the License.
<type>pom</type>
<scope>import</scope>
</dependency>
<!-- Keep all OpenTelemetry API, SDK, and exporter artifacts on the CVE-2026-45292-fixed line. -->
<dependency>
<groupId>io.opentelemetry</groupId>
<artifactId>opentelemetry-bom</artifactId>
<version>${opentelemetry.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson</groupId>
<artifactId>jackson-bom</artifactId>
<version>${jackson.version}</version>
<scope>import</scope>
<type>pom</type>
</dependency>
<!-- Override Spring Boot's vulnerable HttpComponents 5 versions. -->
<dependency>
<groupId>org.apache.httpcomponents.client5</groupId>
<artifactId>httpclient5</artifactId>
<version>${httpclient5.version}</version>
</dependency>
<dependency>
<groupId>org.apache.httpcomponents.core5</groupId>
<artifactId>httpcore5</artifactId>
<version>${httpcore5.version}</version>
</dependency>
<dependency>
<groupId>org.apache.httpcomponents.core5</groupId>
<artifactId>httpcore5-h2</artifactId>
<version>${httpcore5.version}</version>
</dependency>
<!-- First redirect archived org.lz4 dependencies, then select the fixed maintained release. -->
<dependency>
<groupId>org.lz4</groupId>
<artifactId>lz4-java</artifactId>
<version>${lz4-java-relocation.version}</version>
</dependency>
<dependency>
<groupId>at.yawk.lz4</groupId>
<artifactId>lz4-java</artifactId>
<version>${lz4-java.version}</version>
</dependency>
<dependency>
<groupId>org.apache.ivy</groupId>
<artifactId>ivy</artifactId>
Expand Down Expand Up @@ -508,6 +581,15 @@ under the License.
<scope>import</scope>
<type>pom</type>
</dependency>
<!-- The core Jetty BOM does not manage Jakarta EE 10 artifacts; import the matching
EE10 BOM before Spring Boot so the complete Jetty 12 graph stays on 12.0.38. -->
<dependency>
<groupId>org.eclipse.jetty.ee10</groupId>
<artifactId>jetty-ee10-bom</artifactId>
<version>${jetty.version}</version>
<scope>import</scope>
<type>pom</type>
</dependency>
<dependency>
<groupId>org.eclipse.jetty.http2</groupId>
<artifactId>http2-client</artifactId>
Expand Down Expand Up @@ -613,11 +695,11 @@ under the License.
<artifactId>woodstox-core</artifactId>
<version>${woodstox.version}</version>
</dependency>
<!-- bcprov-jdk15on -->
<!-- Replacement for Huawei IAM's vulnerable bcprov-jdk15on dependency. -->
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk15on</artifactId>
<version>${bcprov-jdk15on.version}</version>
<artifactId>bcprov-jdk18on</artifactId>
<version>${bcprov-jdk18on.version}</version>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
Expand Down Expand Up @@ -1813,6 +1895,12 @@ under the License.
<groupId>com.squareup.okio</groupId>
<artifactId>okio</artifactId>
</exclusion>
<!-- Trino 435 pulls a Servlet 5.0 API repackage that shadows Jakarta Servlet
6.1 on the FE classpath and breaks Jetty 12.0.38 cookie handling. -->
<exclusion>
<groupId>org.eclipse.jetty.toolchain</groupId>
<artifactId>jetty-jakarta-servlet-api</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand Down
Loading