Upgrade vulnerable version of reload4j and aws-java-sdk dependencies #24606

ShahimSharafudeen · 2025-02-21T13:15:33Z

Description

Upgrade the aws-java-sdk version to 1.12.640 to fix the ion-java vulnerability - CVE-2024-21634
Upgrade the reload4j version to 1.2.22 to fix the vulnerability WS-2022-0467

Log4j was removed from the reload4j version 1.2.18.4. Therefore, if we upgrade this dependency, it will cause a Cannot instantiate class TestNGException in the Presto-accum module test classes. To resolve this issue, we are adding the latest version of the Apache Log4j 1.x Compatibility API.

Motivation and Context

To resolve the vulnerability issues on the aws-java-sdk and reload4j dependencies.

Impact

Test Plan

Contributor checklist

Please make sure your submission complies with our contributing guide, in particular code style and commit standards.
PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
Documented new properties (with its default value), SQL syntax, functions, or other functionality.
If release notes are required, they follow the release notes guidelines.
Adequate tests were added if applicable.
CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

Security Changes

* Upgrade aws-java-sdk version to 1.12.640 in response to `CVE-2024-21634 <https://nvd.nist.gov/vuln/detail/cve-2024-21634>`_. 
* Upgrade reload4j version to 1.2.22 in response to `WS-2022-0467 <https://www.mend.io/vulnerability-database/WS-2022-0467>`_.

Upgrade the aws-java-sdk version to 1.12.640 to fix the ion-java vulnerability Upgrade the reload4j version to 1.2.22 to fix the vulnerability

steveburnett · 2025-02-24T14:50:06Z

Thanks for the release note entry! Suggest linking to the relevant CVEs. See Phrasing in the Release Notes Guidelines for an example.

Security Changes

* Upgrade aws-java-sdk version to 1.12.640 in response to `CVE-2024-21634 <https://nvd.nist.gov/vuln/detail/cve-2024-21634>`_. 
* Upgrad reload4j version to 1.2.22 in response to `WS-2022-0467 <https://github.com/qos-ch/reload4j/issues/53>`_.

ShahimSharafudeen · 2025-02-24T16:57:20Z

Thanks for the release note entry! Suggest linking to the relevant CVEs. See Phrasing in the Release Notes Guidelines for an example.
Security Changes

* Upgrade aws-java-sdk version to 1.12.640 in response to `CVE-2024-21634 <https://nvd.nist.gov/vuln/detail/cve-2024-21634>`_. 
* Upgrad reload4j version to 1.2.22 in response to `WS-2022-0467 <https://github.com/qos-ch/reload4j/issues/53>`_. 

Thanks, @steveburnett for your feedback. I have updated the release note based on your suggestions.

steveburnett · 2025-02-24T19:34:33Z

Thanks for the release note entry! Suggest linking to the relevant CVEs. See Phrasing in the Release Notes Guidelines for an example.
Security Changes

* Upgrade aws-java-sdk version to 1.12.640 in response to `CVE-2024-21634 <https://nvd.nist.gov/vuln/detail/cve-2024-21634>`_. 
* Upgrad reload4j version to 1.2.22 in response to `WS-2022-0467 <https://github.com/qos-ch/reload4j/issues/53>`_. 
Thanks, @steveburnett for your feedback. I have updated the release note based on your suggestions.

Thanks for updating the release note entry! Sorry about making a mistake in my suggested draft - could you fix my typo in the second line? "Upgrad reload4j" should be "Upgrade reload4j".

agrawalreetika · 2025-02-25T18:37:20Z

pom.xml

@@ -48,7 +48,7 @@
        <dep.packaging.version>${dep.airlift.version}</dep.packaging.version>
        <dep.slice.version>0.38</dep.slice.version>
        <dep.testing-mysql-server-5.version>0.6</dep.testing-mysql-server-5.version>
-        <dep.aws-sdk.version>1.12.560</dep.aws-sdk.version>
+        <dep.aws-sdk.version>1.12.640</dep.aws-sdk.version>


@ShahimSharafudeen Looks like even version 1.12.640 has CVEs for artifact aws-java-sdk-core that uses this SDK version in Presto.
https://mvnrepository.com/artifact/com.amazonaws/aws-java-sdk-core/1.12.640 (But it looks like those CVEs are in test dependencies)

Other 2 AWS artifact aws-java-sdk-glue & aws-java-sdk-s3 are CVEs free even with existing aws version 1.12.560

@agrawalreetika - If we check version 1.12.560, we can see that an ion-java vulnerability exists there. In version 1.12.640, it was resolved and has no vulnerabilities. So, we used the resolved version here.

We should just upgrade to the latest version (1.12.782) to ensure it solves as many CVEs as possible.

agrawalreetika · 2025-02-25T18:54:17Z

presto-accumulo/pom.xml

@@ -16,7 +16,7 @@
        <air.main.basedir>${project.parent.basedir}</air.main.basedir>
        <dep.accumulo.version>1.10.1</dep.accumulo.version>
        <dep.curator.version>2.12.0</dep.curator.version>
-        <dep.reload4j.version>1.2.18.3</dep.reload4j.version>
+        <dep.reload4j.version>1.2.22</dep.reload4j.version>


Why this upgrade? I see exsiting and new both the version has CVEs coming from test dependencies-
https://mvnrepository.com/artifact/ch.qos.reload4j/reload4j/1.2.18.3
https://mvnrepository.com/artifact/ch.qos.reload4j/reload4j/1.2.22

I don't see that's resolved even on latest version.

@agrawalreetika - Regarding the reload4j dependency, we can see a vulnerability identified by the Mend tool scan (OSS Scan - WS-2022-0467), which is also described in the PR description. The fix is only available in reload4j version 1.2.22

We should just upgrade to the latest (1.2.26) if it does actually resolve a CVE. However, as Reetika pointed out, the mvnrepository link shows the CVE has not been resolved in any new version.

@ShahimSharafudeen can you link to the specific CVE the scan was reporting. The github issue linked has no attached CVE.

ZacBlanco · 2025-02-27T20:40:25Z

presto-accumulo/pom.xml

+                <artifactId>duplicate-finder-maven-plugin</artifactId>
+                <configuration>
+                    <ignoredResourcePatterns>
+                        <ignoredResourcePattern>org/apache/log4j/xml/log4j.dtd</ignoredResourcePattern>
+                    </ignoredResourcePatterns>
+                    <ignoredClassPatterns>
+                        <ignoredClassPattern>org.apache.log4j.*</ignoredClassPattern>
+                    </ignoredClassPatterns>


We should not be ignoring duplicates. The duplicates need to be handled by excluding the dependencies

ZacBlanco · 2025-02-27T20:43:16Z

presto-accumulo/pom.xml

@@ -16,7 +16,7 @@
        <air.main.basedir>${project.parent.basedir}</air.main.basedir>
        <dep.accumulo.version>1.10.1</dep.accumulo.version>
        <dep.curator.version>2.12.0</dep.curator.version>
-        <dep.reload4j.version>1.2.18.3</dep.reload4j.version>
+        <dep.reload4j.version>1.2.22</dep.reload4j.version>


We should just upgrade to the latest (1.2.26) if it does actually resolve a CVE. However, as Reetika pointed out, the mvnrepository link shows the CVE has not been resolved in any new version.

@ShahimSharafudeen can you link to the specific CVE the scan was reporting. The github issue linked has no attached CVE.

ZacBlanco · 2025-02-27T20:45:23Z

pom.xml

@@ -48,7 +48,7 @@
        <dep.packaging.version>${dep.airlift.version}</dep.packaging.version>
        <dep.slice.version>0.38</dep.slice.version>
        <dep.testing-mysql-server-5.version>0.6</dep.testing-mysql-server-5.version>
-        <dep.aws-sdk.version>1.12.560</dep.aws-sdk.version>
+        <dep.aws-sdk.version>1.12.640</dep.aws-sdk.version>


We should just upgrade to the latest version (1.12.782) to ensure it solves as many CVEs as possible.

prestodb-ci added the from:IBM PR from IBM label Feb 21, 2025

ShahimSharafudeen force-pushed the prestodb_forwardfit_CVE_fix_ion-java branch from 70da419 to ca2dee0 Compare February 21, 2025 15:09

Upgrade vulnerable version of reload4j and aws-java-sdk dependencies

46e1d2a

Upgrade the aws-java-sdk version to 1.12.640 to fix the ion-java vulnerability Upgrade the reload4j version to 1.2.22 to fix the vulnerability

ShahimSharafudeen force-pushed the prestodb_forwardfit_CVE_fix_ion-java branch from ca2dee0 to 46e1d2a Compare February 24, 2025 07:25

ShahimSharafudeen marked this pull request as ready for review February 24, 2025 12:04

ShahimSharafudeen requested a review from a team as a code owner February 24, 2025 12:04

ShahimSharafudeen requested a review from jaystarshot February 24, 2025 12:04

imjalpreet self-requested a review February 25, 2025 09:25

agrawalreetika requested changes Feb 25, 2025

View reviewed changes

ZacBlanco requested changes Feb 27, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Upgrade vulnerable version of reload4j and aws-java-sdk dependencies #24606

Upgrade vulnerable version of reload4j and aws-java-sdk dependencies #24606

ShahimSharafudeen commented Feb 21, 2025 •

edited

Loading

steveburnett commented Feb 24, 2025

ShahimSharafudeen commented Feb 24, 2025

steveburnett commented Feb 24, 2025

agrawalreetika Feb 25, 2025 •

edited

Loading

ShahimSharafudeen Feb 26, 2025

ZacBlanco Feb 27, 2025

agrawalreetika Feb 25, 2025

ShahimSharafudeen Feb 26, 2025 •

edited

Loading

ZacBlanco Feb 27, 2025

ZacBlanco Feb 27, 2025

ZacBlanco Feb 27, 2025

ZacBlanco Feb 27, 2025

Upgrade vulnerable version of reload4j and aws-java-sdk dependencies #24606

Are you sure you want to change the base?

Upgrade vulnerable version of reload4j and aws-java-sdk dependencies #24606

Conversation

ShahimSharafudeen commented Feb 21, 2025 • edited Loading

Description

Motivation and Context

Impact

Test Plan

Contributor checklist

Release Notes

steveburnett commented Feb 24, 2025

ShahimSharafudeen commented Feb 24, 2025

steveburnett commented Feb 24, 2025

agrawalreetika Feb 25, 2025 • edited Loading

Choose a reason for hiding this comment

ShahimSharafudeen Feb 26, 2025

Choose a reason for hiding this comment

ZacBlanco Feb 27, 2025

Choose a reason for hiding this comment

agrawalreetika Feb 25, 2025

Choose a reason for hiding this comment

ShahimSharafudeen Feb 26, 2025 • edited Loading

Choose a reason for hiding this comment

ZacBlanco Feb 27, 2025

Choose a reason for hiding this comment

ZacBlanco Feb 27, 2025

Choose a reason for hiding this comment

ZacBlanco Feb 27, 2025

Choose a reason for hiding this comment

ZacBlanco Feb 27, 2025

Choose a reason for hiding this comment

ShahimSharafudeen commented Feb 21, 2025 •

edited

Loading

agrawalreetika Feb 25, 2025 •

edited

Loading

ShahimSharafudeen Feb 26, 2025 •

edited

Loading