tez/0.10.5-r7: cve remediation

[octo-sts]

tez/0.10.5-r7: fix GHSA-84h7-rjj3-6jx4

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/tez.advisories.yaml

---

"Breadcrumbs" for this automated service

• Source Code: https://go/cve-remedy-automation-source
• Logs: https://go/cve-remedy-automation-logs
• Docs: (not provided yet)

Inspected git repositories: https://github.com/apache/tez@rel/release-0.10.5

[octo-sts]

📦 Build Failed: Missing Dependency

package io.netty.handler.codec.http does not exist

Build Details

Category	Details
Build System	Maven
Failure Point	maven-compiler-plugin:3.8.1:compile (default-compile) on project tez-runtime-library

Root Cause Analysis 🔍

The build is failing because the Netty HTTP codec package is not available in the classpath. While netty-handler-4.1.125.Final.jar was downloaded from Chainguard, the specific io.netty.handler.codec.http package that TezBodyDeferringAsyncHandler is trying to import is missing. This suggests either an incomplete Netty dependency or a version mismatch where the required HTTP codec classes are not included in the available Netty artifacts.

---

🔍 Build failure fix suggestions

Found similar build failures that have been fixed in the past and analyzed them to suggest a fix:

Similar PRs with fixes

• apache-pulsar/4.0.6-r1: cve remediation #65204

Suggested Changes

File: tez/pombump-properties.yaml

• create_file
  Replacement:

properties:
  - property: netty4.version
    value: "4.1.127.Final"

Content:

Create a new pombump-properties.yaml file to define Netty version property

File: tez/pombump-deps.yaml

• modify
  Replacement:

patches:
  - groupId: io.netty
    artifactId: netty-codec-http
    version: 4.1.127.Final

Content:

Add or update Netty HTTP codec dependency in the patches section

Click to expand fix analysis

Analysis

Looking at the similar fixes, there's a clear pattern: all three cases involved Netty dependency issues that were resolved by updating the Netty version in properties files. In Fix Examples #0 and #1, the netty4.version was updated from 4.1.118.Final to 4.1.127.Final in hadoop-project-pombump-properties.yaml, and some specific Netty codec dependencies were removed from pombump-deps.yaml. In Fix Example #2, the netty.version was updated from 4.1.124.Final to 4.1.125.Final in pombump-properties.yaml. The common solution is updating Netty to a newer version that contains the required HTTP codec classes.

Click to expand fix explanation

Explanation

The build is failing because the io.netty.handler.codec.http package is not available, even though netty-handler-4.1.125.Final.jar was downloaded. This indicates a version compatibility issue where the current Netty version doesn't include the required HTTP codec classes or they're in a separate artifact. Based on the similar fixes, updating to Netty 4.1.127.Final should resolve this issue because: 1) This version has been proven to work in similar Hadoop-related projects with the same error, 2) The HTTP codec classes are properly included in this version, 3) The pombump mechanism will ensure all Netty dependencies are consistently updated to this version across the project. The netty-codec-http artifact specifically contains the io.netty.handler.codec.http package that TezBodyDeferringAsyncHandler is trying to import.

Click to expand alternative approaches

Alternative Approaches

• Add netty-all dependency instead of individual Netty artifacts to ensure all required packages are available
• Use a different Netty version like 4.1.125.Final but explicitly include the netty-codec-http artifact
• Update the Tez source code to use a different HTTP client library if Netty dependencies continue to be problematic

---

Was this comment helpful? Please use 👍 or 👎 reactions on this comment.

[debasishbsws]

adv: wolfi-dev/advisories#28173

[Ankush-Pathak]

Advisory merged