tez/0.10.4-r7: cve remediation

[octo-sts]

tez/0.10.4-r7: fix GHSA-4g8c-wm8x-jfhw

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/tez.advisories.yaml

---

"Breadcrumbs" for this automated service

• Source Code: https://go/cve-remedy-automation-source
• Logs: https://go/cve-remedy-automation-logs
• Docs: (not provided yet)

[octo-sts]

📦 Build Failed: Missing Dependency

package io.netty.handler.ssl does not exist

Build Details

Category	Details
Build System	Maven
Failure Point	maven-compiler-plugin:3.8.1:compile (default-compile) on project tez-runtime-library

Root Cause Analysis 🔍

The build is missing required Netty SSL dependencies. The code in SSLFactory.java is trying to use classes from io.netty.handler.ssl package (JdkSslContext, SupportedCipherSuiteFilter), but these classes are not available on the classpath.

---

🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Similar PRs with fixes

• kserve-modelmesh/0.12.0-r6: cve remediation #42316
• docker-selenium/4.31.0.20250404 package update #49356
• wildfly/35.0.1-r0: cve remediation #42897

Suggested Changes

File: pombump-deps.yaml

• create
  Content:

patches:
  - groupId: io.netty
    artifactId: netty-handler
    version: 4.1.118.Final
  - groupId: io.netty
    artifactId: netty-transport-native-epoll
    version: 4.1.118.Final
  - groupId: io.netty
    artifactId: netty-codec-http
    version: 4.1.118.Final

File: pombump-properties.yaml

• create
  Content:

properties:
  - property: netty.version
    value: 4.1.118.Final

Click to expand fix analysis

Analysis

Looking at the similar fixed build failures, the common pattern is missing Netty SSL dependencies, particularly from the io.netty.handler.ssl package. Each fix addressed this by either:

1. Updating the Netty version to a compatible release (4.1.118.Final in two examples)
2. Adding the missing Netty dependencies explicitly in pombump configuration
3. Using properties files rather than direct dependency patches for better dependency resolution

The current error shows the same pattern - the build is missing required Netty SSL classes (particularly JdkSslContext and SupportedCipherSuiteFilter from io.netty.handler.ssl) which need to be added to the classpath.

Click to expand fix explanation

Explanation

The suggested changes address the root cause of the build failure by explicitly adding the necessary Netty dependencies to the build.

The current failure occurs because the code in SSLFactory.java is trying to use classes from io.netty.handler.ssl package (specifically JdkSslContext and SupportedCipherSuiteFilter), but these classes are not available on the classpath. The netty-handler artifact contains the SSL handler classes that are missing.

I'm recommending Netty version 4.1.118.Final based on the successful fixes in two of the similar examples. This version is recent and stable, which aligns with Wolfi's principle of keeping packages up to date.

The solution adds three key Netty dependencies:

1. netty-handler - Contains the SSL handler classes directly referenced in the error
2. netty-transport-native-epoll - Often required alongside netty-handler for proper SSL functionality
3. netty-codec-http - Provides HTTP protocol support which is often used with Netty SSL

Additionally, I'm creating a properties file to set the netty.version property which helps ensure consistent versions across transitive dependencies. This approach was successful in fix examples #2 and #3 and helps prevent version conflicts.

This approach should resolve the compilation error by providing the missing classes while maintaining compatibility with the existing build system.

Click to expand alternative approaches

Alternative Approaches

• Use just the properties file approach (without explicit dependencies) like in fix example Add pax-utils into the OS. #2, relying on the project's internal dependency management to pull in the correct versions
• Add only the netty-handler dependency which contains the specific missing classes, though this risks further dependency issues with related Netty components
• Add explicit dependencies on netty-handler-ssl and netty-handler-ssl-ocsp directly if the project specifically needs those components
• Use a more comprehensive approach by updating other related dependencies beyond just Netty to ensure full compatibility

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[kbsteere]

Advisories for un-patched packages: wolfi-dev/advisories#18778