Skip to content

fix: address Jackson 1 and Netty vulnerabilities #19808

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
FrankChen021 wants to merge 9 commits into
base: master
Choose a base branch
from
+5 −51
Open

fix: address Jackson 1 and Netty vulnerabilities #19808

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
0a388ac
Remove vulnerable Jackson 1 dependencies
FrankChen021 Jul 30, 2026
6418030
fix: update Netty security handling
FrankChen021 Jul 30, 2026
ee5d98c
fix: update Netty license metadata
FrankChen021 Jul 30, 2026
25e4abb
fix: validate Netty 3 suppression
FrankChen021 Jul 31, 2026
cbea7e6
Merge remote-tracking branch 'origin/master' into codex/pr-19808-resolve
FrankChen021 Aug 3, 2026
79bf16a
Fix web console dependency vulnerabilities
FrankChen021 Jul 30, 2026
74081f9
fix: map browser global to globalThis
FrankChen021 Jul 30, 2026
432cb7e
Revert "fix: map browser global to globalThis"
FrankChen021 Aug 3, 2026
31fedb7
Revert "Fix web console dependency vulnerabilities"
FrankChen021 Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 0 additions & 10 deletions extensions-contrib/ambari-metrics-emitter/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,16 +119,6 @@
<artifactId>JUnitParams</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.codehaus.jackson</groupId>
<artifactId>jackson-core-asl</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.codehaus.jackson</groupId>
<artifactId>jackson-mapper-asl</artifactId>
<scope>test</scope>
</dependency>
</dependencies>

<build>
Expand Down
4 changes: 2 additions & 2 deletions licenses.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1486,7 +1486,7 @@ name: Netty
license_category: binary
module: java-core
license_name: Apache License version 2.0
version: 4.2.15.Final
version: 4.2.16.Final
libraries:
- io.netty: netty-buffer
- io.netty: netty-codec
Expand Down Expand Up @@ -4803,7 +4803,7 @@ name: Netty
license_category: binary
module: extensions/druid-azure-extensions
license_name: Apache License version 2.0
version: 2.0.77.Final
version: 2.0.78.Final
libraries:
- io.netty: netty-tcnative-boringssl-static
- io.netty: netty-tcnative-classes
Expand Down
29 changes: 2 additions & 27 deletions owasp-dependency-check-suppressions.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,39 +241,14 @@
<cve>CVE-2023-0833</cve> <!-- Suppressed since okhttp requests in Druid are internal, and not user-facing -->
</suppress>

<suppress>
<!-- TODO: Fix by updating ambari-metrics-emitter's transitive hadoop dependency -->
<notes><![CDATA[
file name: jackson-mapper-asl-1.9.13.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.codehaus\.jackson/jackson\-mapper\-asl@1.9.13$</packageUrl>
<cvssBelow>10</cvssBelow> <!-- suppress all CVEs for jackson-mapper-asl:1.9.13; pulled in (test scope only) via ambari-metrics-emitter -->
</suppress>

<suppress>
<!-- TODO: Fix by updating org.apache.druid.java.util.http.client.NettyHttpClient to use netty 4 -->
<notes><![CDATA[
file name: netty-3.10.6.Final.jar
]]></notes>
<packageUrl regex="true">^pkg:maven/io\.netty/netty@3.10.6.Final$</packageUrl>
<cve>CVE-2019-16869</cve>
<cve>CVE-2019-20444</cve>
<cve>CVE-2019-20445</cve>
<cve>CVE-2020-11612</cve>
<cve>CVE-2021-21290</cve> <!-- We don't use HttpPostRequestDecoder or HttpPostMultiPartRequestDecoder which uses vulnerable AbstractDiskHttpData - https://github.com/advisories/GHSA-5mcr-gq6c-3hq2 -->
<cve>CVE-2021-21295</cve> <!-- We don't use HTTP2MultiplexCodec or Http2FrameCodec or Http2StreamFrameToHttpObjectCodec affected or convert HTTP/2 to HTTP/1.1 requests - https://github.com/advisories/GHSA-wm47-8v5p-wjpj -->
<cve>CVE-2021-21409</cve> <!-- We don't use Http2HeaderFrame or convert HTTP/2 to HTTP/1.1 requests https://github.com/advisories/GHSA-f256-j965-7f32 -->
<cve>CVE-2021-37136</cve>
<cve>CVE-2021-37137</cve>
<cve>CVE-2021-43797</cve> <!-- We don't decode user HTTP requests nor forward them to remote systems, we also don't support for java 6 or lower - https://github.com/advisories/GHSA-wx5j-54mm-rqqq -->
<cve>CVE-2022-24823</cve> <!-- We don't decode user HTTP requests nor forward them to remote systems, we also don't support for java 6 or lower - https://github.com/advisories/GHSA-269q-hmxg-m83q -->
<cve>CVE-2022-41881</cve>
<cve>CVE-2023-34462</cve> <!-- Suppressed since netty requests in Druid are internal, and not user-facing -->
<cve>CVE-2025-55163</cve> <!-- Netty 3.x not affected; HTTP/2 issues only in 4.x -->
<cve>CVE-2025-58056</cve>
<cve>CVE-2025-58057</cve> <!-- Netty 3.x not affected; compression issue only in 4.x -->
<cve>CVE-2026-33870</cve> <!-- We don't use HttpPostRequestDecoder -->
<cve>CVE-2026-33871</cve> <!-- Netty 3.x not affected; HTTP/2 issues only in 4.x -->
<!-- Netty 3 is EOL and cannot be upgraded independently. Replacing Druid's NettyHttpClient with Netty 4 is required. -->
<vulnerabilityName regex="true">.*</vulnerabilityName>

@FrankChen021 FrankChen021 Jul 31, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P1] Keep future Netty 3 advisories visible

This wildcard suppresses every current and future vulnerability reported for io.netty:netty:3.10.6.Final. Druid still executes this EOL dependency through NettyHttpClient, so a newly disclosed vulnerability affecting an actual runtime path would silently pass the OWASP CI scan. Please retain individually assessed CVE suppressions, optionally with suppressUntil, so new advisories remain visible and trigger assessment or migration.

@FrankChen021 FrankChen021 Aug 3, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P2] Keep future Netty 3 advisories visible

The .* vulnerability-name rule suppresses every current and future advisory for io.netty:netty:3.10.6.Final. Druid still executes this EOL dependency through NettyHttpClient, so a newly disclosed vulnerability affecting a reachable runtime path would silently pass OWASP CI. Retain individually assessed CVE suppressions, optionally with expirations, so new advisories remain visible.

</suppress>

<suppress>
Expand Down
13 changes: 1 addition & 12 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,12 +107,11 @@
<jetty.version>12.1.11</jetty.version>
<jersey.version>1.19.4</jersey.version>
<jackson.version>2.22.1</jackson.version>
<codehaus.jackson.version>1.9.13</codehaus.jackson.version>
<log4j.version>2.26.0</log4j.version>
<mysql.version>8.2.0</mysql.version>
<mariadb.version>2.7.3</mariadb.version>
<netty3.version>3.10.6.Final</netty3.version>
<netty4.version>4.2.15.Final</netty4.version>
<netty4.version>4.2.16.Final</netty4.version>
<postgresql.version>42.7.12</postgresql.version>
<protobuf.version>4.35.1</protobuf.version>
<resilience4j.version>1.3.1</resilience4j.version>
Expand Down Expand Up @@ -1171,16 +1170,6 @@
<artifactId>metrics-core</artifactId>
<version>${dropwizard.metrics.version}</version>
</dependency>
<dependency>
<groupId>org.codehaus.jackson</groupId>
<artifactId>jackson-core-asl</artifactId>
<version>${codehaus.jackson.version}</version>
</dependency>
<dependency>
<groupId>org.codehaus.jackson</groupId>
<artifactId>jackson-mapper-asl</artifactId>
<version>${codehaus.jackson.version}</version>
</dependency>
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
Expand Down
Loading