neo4j/5.24.2-r0: cve remediation

[octo-sts]

Unfortunately, not all the CVEs listed in this PR (initially), can be remediated. Removed those which could not, and filed an advisory for the other:

• neo4j: Raising pending-upstream-fix advisory for: GHSA-qh8g-58pp-2wxh advisories#9165

Note, there is a separate netty-common finding which is now being picked up by the scanners but wasn't included in this PR. I am unable to find the source for this, as there is no netty-common dep defined in any pom.xml's that I can see. Couldn't easily pin this one down. But not holding up getting the other fix merged and will address separately.

---

neo4j/5.24.2-r0: fix GHSA-735f-pc8j-v9w8/GHSA-qh8g-58pp-2wxh/GHSA-g8m5-722r-8whq/

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/neo4j.advisories.yaml

[octo-sts]

Gen AI suggestions to solve the build error:

Based on the error log, this appears to be a Maven dependency convergence issue with conflicting Jetty dependencies. Here are some steps to resolve it:

1. The main conflicts are with Jetty dependencies:

• jetty-util:jar versions 12.0.12 vs 10.0.20
• jetty-io:jar versions 12.0.12 vs 10.0.24 vs 10.0.20

2. To fix this, you can try:

# In your melange.yaml, add dependency management section:
environment:
  patches:
    - dependency: "org.eclipse.jetty:jetty-util"
      version: "12.0.12"
    - dependency: "org.eclipse.jetty:jetty-io" 
      version: "12.0.12"
    - dependency: "org.eclipse.jetty:jetty-http"
      version: "12.0.12"

3. Alternatively, add Maven enforcer plugin exclusions:

pipeline:
  - runs: |
      mvn -DskipTests clean package -Denforcer.skip=true

4. Or force align all Jetty versions to 12.0.12:

environment:
  properties:
    jetty.version: "12.0.12"

The safest approach would be #4 to align all Jetty dependencies to the same version. This should resolve the dependency convergence errors.

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error:

Dependency convergence error for org.eclipse.jetty:jetty-util:jar:12.0.12
[...] 
Dependency convergence error for org.eclipse.jetty:jetty-io:jar:12.0.12

• Error Category: Dependency

• Failure Point: Maven enforcer plugin dependency convergence check during build

• Root Cause Analysis: There are version conflicts in the Jetty dependencies. The build is using both Jetty 10.0.24 and 12.0.12 versions, which the enforcer plugin won't allow.

• Suggested Fix:
Add dependency management section to force consistent Jetty versions:

pipeline:
  - uses: git-checkout
    with:
      repository: https://github.com/neo4j/neo4j
      tag: ${{package.version}}
      expected-commit: 054967fbed84a78ebf6eae3cae059c8811871f2e

  - uses: maven/pombump
    with:
      force-dependencies:
        - "org.eclipse.jetty:jetty-util:10.0.24"
        - "org.eclipse.jetty:jetty-io:10.0.24"
        - "org.eclipse.jetty:jetty-http:10.0.24"

  - runs: |
      export LANG=en_US.UTF-8
      mvn package -DskipTests=true -T$(nproc)C -q
      # ... rest of the build steps

• Explanation: The enforcer plugin is failing because there are multiple versions of Jetty dependencies in use. By explicitly forcing the versions to align with 10.0.24 (which appears to be the primary version in use), we resolve the convergence conflicts.

• Additional Notes:

• Neo4j 5.25.1 appears to primarily use Jetty 10.0.24
• The conflict seems introduced by a transitive dependency pulling in Jetty 12.0.12
• Using version 10.0.24 is safer as it's the version explicitly specified in most dependencies

• References:

• Maven Enforcer Plugin: https://maven.apache.org/enforcer/maven-enforcer-plugin/enforce-mojo.html
• Jetty Version Compatibility: https://eclipse.dev/jetty/documentation/
• Neo4j Server Dependencies: https://github.com/neo4j/neo4j/blob/5.25.1/pom.xml

[mamccorm]

It does not look like we can remediate GHSA-qh8g-58pp-2wxh (jetty-http). Bumping it to the 'fixed version' introduces a chain of dependency issues, which in turn are dependent on different versions of jetty.

I attempted to bump jetty.version using pombump-properties, but that failed as one of the dependencies - jetty-webapp, has been re-located to a new location on maven central, for v12.x and later. See note added here:

• https://mvnrepository.com/artifact/org.eclipse.jetty/jetty-servlet

I tried creating a git patch to first re-name this dependency to the new maven location, then bump the jetty.version, but still running into various dependency issues. This one will require a fix from upstream.

I'll remove jetty-http from the pombump items and see if the others succeed

[github-actions]

Package neo4j: Click to expand/collapse

Package neo4j:
Modified: /usr/share/java/neo4j/lib/annotations-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/cypher-antlr-ast-common-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/cypher-antlr-common-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/cypher-ast-factory-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/cypher-parser-ast-common-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/cypher-parser-common-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/cypher-parser-factory-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/cypher-shell-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/cypher-v25-antlr-parser-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/cypher-v25-ast-factory-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/cypher-v25-parser-listener-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/cypher-v5-antlr-parser-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/cypher-v5-ast-factory-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/cypher-v5-literal-interpreter-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/cypher-v5-parser-listener-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-ast-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-bolt-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-bootcheck-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-capabilities-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cloud-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-codegen-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-collections-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-command-line-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-common-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-concurrent-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-configuration-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-consistency-check-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-csv-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-ast-factory-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-cache-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-config-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-expression-evaluator-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-interpreted-runtime-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-ir-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-javacc-parser-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-logical-plans-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-macros-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-physical-planning-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-planner-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-planner-spi-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-rendering-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-runtime-util-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-cypher-slotted-runtime-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-data-collector-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-dbms-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-diagnostics-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-exceptions-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-expressions-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-fabric-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-front-end-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-fulltext-index-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-gql-status-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-graph-algo-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-graphdb-api-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-id-generator-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-import-api-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-import-tool-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-import-util-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-index-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-io-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-kernel-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-kernel-api-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-layout-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-lock-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-logging-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-lucene-index-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-monitoring-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-native-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-notifications-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-procedure-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-procedure-api-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-push-to-cloud-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-query-router-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-record-storage-engine-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-resource-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-rewriting-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-schema-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-security-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-server-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-slf4j-provider-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-spatial-index-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-ssl-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-storage-engine-util-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-token-api-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-udc-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-unsafe-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-util-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-values-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/neo4j-wal-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/server-api-5.25.1.jar
Modified: /usr/share/java/neo4j/lib/zstd-proxy-5.25.1.jar
Modified: /usr/share/java/neo4j/products/neo4j-genai-plugin-5.25.1.jar

Package neo4j-oci-entrypoint: Click to expand/collapse

Package neo4j-oci-entrypoint:
Unchanged