Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade some libraries to fix the security vulnerabilities #72

Merged
merged 1 commit into from
Aug 31, 2022

Conversation

yiqiangin
Copy link
Contributor

@yiqiangin yiqiangin commented Aug 31, 2022

This PR fixes the security vulnerabilities brought by the old version of snakeyaml.
The existing version of jackson-dataformat-yaml is 2.9.9 and the existing version of cassandra-all is 3.11.2 use snakeyaml of versions 1.23 and 1.11 respectively. As shown in https://nvd.nist.gov/vuln/detail/CVE-2017-18640, the versions of snakeyaml before 1.26 have the security vulnerability.
Upgrading the version of jackson-dataformat-yaml to 2.13.2 and the version of cassandra-all to 3.11.13 to use the version of snakeyaml 1.30.

Test:

  • ./gradlew build to build and test Calcite
  • including the locally built Calcite in Coral and build and test with ./gradlew build

@yiqiangin yiqiangin requested a review from ljfgem August 31, 2022 15:26
@ljfgem
Copy link
Contributor

ljfgem commented Aug 31, 2022

Could you elaborate the reason of upgrading these 2 dependencies? Are they using the old version of snakeyaml?
Please also add the test part (i.e. if it could be built with the change, and if Coral could be built with this modified calcite)?

@aastha25
Copy link
Contributor

+1 to Jiefan's comments. Please elaborate on the security vulnerability, how the fix is related to it, and the integration testing done with Coral.

@yiqiangin
Copy link
Contributor Author

Description are revised to address the comments

Copy link
Contributor

@ljfgem ljfgem left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@yiqiangin yiqiangin merged commit 6853dc8 into linkedin:li-1.21.0 Aug 31, 2022
@wmoustafa
Copy link

Thanks @yiqiangin! Could you please create a Coral PR to use that version of Calcite?

@yiqiangin
Copy link
Contributor Author

Thanks @yiqiangin! Could you please create a Coral PR to use that version of Calcite?

Will do, I am waiting for Raymond to publish the new version of Calcite

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants