CVE patches #5034
CVE patches #5034
Conversation
Codecov Report
@@ Coverage Diff @@
## master #5034 +/- ##
===========================================
- Coverage 83.77% 35.98% -47.79%
===========================================
Files 202 202
Lines 9818 9818
Branches 416 416
===========================================
- Hits 8225 3533 -4692
- Misses 1593 6285 +4692
Continue to review full report at Codecov.
|
|
Thanks @mluds for these patches! |
|
Hi @mluds. If you rebase the codes, the CI pipeline would work as expected. |
| @@ -98,6 +98,38 @@ dependencies { | |||
| compile ("com.azure:azure-storage-blob:12.6.0") { | |||
| exclude group: "com.azure", module: "azure-core-test" | |||
| } | |||
|
|
|||
There was a problem hiding this comment.
I don't understand the reason for these new dependencies being introduced here.
There was a problem hiding this comment.
They appear to be transitive dependencies from actual dependencies we declare.
I started this pr yesterday to clear all known CVE's before realizing this one existed. I think we can upgrade the actual dependencies rather than pin transitive dependencies. I'll take what I can from here, but I'm probably going to do things in multiple PR's so I'm not disrupting too much at once until I have cleared everything. I would much rather upgrade dependencies where I can and then pin transitive dependency versions as a last resort.
settings.gradle
Outdated
| @@ -68,3 +68,6 @@ gradle.ext.akka_management = [version : '1.0.5'] | |||
|
|
|||
| gradle.ext.curator = [version : '4.0.0'] | |||
| gradle.ext.kube_client = [version: '4.4.2'] | |||
|
|
|||
Codecov Report
@@ Coverage Diff @@
## master #5034 +/- ##
==========================================
- Coverage 66.46% 66.01% -0.46%
==========================================
Files 240 233 -7
Lines 14569 14305 -264
Branches 642 638 -4
==========================================
- Hits 9684 9443 -241
+ Misses 4885 4862 -23 📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
Upgrade various gradle dependencies to fix CVEs.
Description
The following CVEs were patched. Shown are the versions before and after the patch.
https://nvd.nist.gov/vuln/detail/CVE-2015-5237
com.google.protobuf:protobuf-java 3.3.1 -> 3.14.0https://nvd.nist.gov/vuln/detail/CVE-2017-18640
org.yaml:snakeyaml 1.23 -> 1.27https://nvd.nist.gov/vuln/detail/CVE-2018-8023
org.apache.mesos:mesos 1.2.3 -> 1.4.3https://nvd.nist.gov/vuln/detail/CVE-2018-20200
com.squareup.okhttp3:okhttp 3.12.0 -> 3.12.12https://nvd.nist.gov/vuln/detail/CVE-2020-7014
org.elasticsearch.client:elasticsearch-rest-client 6.7.2 -> 6.8.13https://nvd.nist.gov/vuln/detail/CVE-2020-11612
io.netty:netty-buffer (and others) 4.1.45.Final -> 4.1.55.Finalhttps://nvd.nist.gov/vuln/detail/CVE-2020-13956
org.apache.httpcomponents:httpclient 4.5.5 -> 4.5.13https://nvd.nist.gov/vuln/detail/CVE-2020-25649
com.fasterxml.jackson.core:jackson-databind 2.10.1 -> 2.10.5.1https://nvd.nist.gov/vuln/detail/CVE-2019-0201
org.apache.zookeeper:zookeeper 3.4.11 -> 3.4.14Related issue and scope
My changes affect the following components
Types of changes
Checklist: