From 488795bf23316484b89427cb539b7433e9be5205 Mon Sep 17 00:00:00 2001 From: Keerthana Srikanth Date: Thu, 14 Dec 2023 00:14:05 +0530 Subject: [PATCH] Upgrade pac4j-oidc to 4.5.7 to address CVE-2021-44878 (#15522) * Upgrade org.pac4j:pac4j-oidc to 4.5.5 to address CVE-2021-44878 * add CVE suppression and notes, since vulnerability scan still shows this CVE * Add tests to improve coverage --- extensions-core/druid-pac4j/pom.xml | 2 +- .../druid/security/pac4j/Pac4jFilter.java | 17 +- .../security/pac4j/Pac4jSessionStore.java | 21 +- .../security/pac4j/Pac4jSessionStoreTest.java | 78 +- licenses.yaml | 6 +- owasp-dependency-check-suppressions.xml | 952 +++++++----------- 6 files changed, 471 insertions(+), 605 deletions(-) diff --git a/extensions-core/druid-pac4j/pom.xml b/extensions-core/druid-pac4j/pom.xml index a8cb8b3a08bf..a330f34c71f6 100644 --- a/extensions-core/druid-pac4j/pom.xml +++ b/extensions-core/druid-pac4j/pom.xml @@ -34,7 +34,7 @@ - 3.8.3 + 4.5.7 1.7 diff --git a/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jFilter.java b/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jFilter.java index 4463e43ca29d..452a22609460 100644 --- a/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jFilter.java +++ b/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jFilter.java @@ -23,14 +23,15 @@ import org.apache.druid.server.security.AuthConfig; import org.apache.druid.server.security.AuthenticationResult; import org.pac4j.core.config.Config; -import org.pac4j.core.context.J2EContext; +import org.pac4j.core.context.JEEContext; import org.pac4j.core.context.session.SessionStore; import org.pac4j.core.engine.CallbackLogic; import org.pac4j.core.engine.DefaultCallbackLogic; import org.pac4j.core.engine.DefaultSecurityLogic; import org.pac4j.core.engine.SecurityLogic; +import org.pac4j.core.exception.http.HttpAction; import org.pac4j.core.http.adapter.HttpActionAdapter; -import org.pac4j.core.profile.CommonProfile; +import org.pac4j.core.profile.UserProfile; import javax.servlet.Filter; import javax.servlet.FilterChain; @@ -47,12 +48,12 @@ public class Pac4jFilter implements Filter { private static final Logger LOGGER = new Logger(Pac4jFilter.class); - private static final HttpActionAdapter NOOP_HTTP_ACTION_ADAPTER = (int code, J2EContext ctx) -> null; + private static final HttpActionAdapter NOOP_HTTP_ACTION_ADAPTER = (HttpAction code, JEEContext ctx) -> null; private final Config pac4jConfig; - private final SecurityLogic securityLogic; - private final CallbackLogic callbackLogic; - private final SessionStore sessionStore; + private final SecurityLogic securityLogic; + private final CallbackLogic callbackLogic; + private final SessionStore sessionStore; private final String name; private final String authorizerName; @@ -88,7 +89,7 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo HttpServletRequest httpServletRequest = (HttpServletRequest) servletRequest; HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse; - J2EContext context = new J2EContext(httpServletRequest, httpServletResponse, sessionStore); + JEEContext context = new JEEContext(httpServletRequest, httpServletResponse, sessionStore); if (Pac4jCallbackResource.SELF_URL.equals(httpServletRequest.getRequestURI())) { callbackLogic.perform( @@ -101,7 +102,7 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo String uid = securityLogic.perform( context, pac4jConfig, - (J2EContext ctx, Collection profiles, Object... parameters) -> { + (JEEContext ctx, Collection profiles, Object... parameters) -> { if (profiles.isEmpty()) { LOGGER.warn("No profiles found after OIDC auth."); return null; diff --git a/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java b/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java index 069a4ff2eb9a..6c5c57a33198 100644 --- a/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java +++ b/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java @@ -25,12 +25,12 @@ import org.apache.druid.java.util.common.logger.Logger; import org.pac4j.core.context.ContextHelper; import org.pac4j.core.context.Cookie; -import org.pac4j.core.context.Pac4jConstants; import org.pac4j.core.context.WebContext; import org.pac4j.core.context.session.SessionStore; import org.pac4j.core.exception.TechnicalException; import org.pac4j.core.profile.CommonProfile; import org.pac4j.core.util.JavaSerializationHelper; +import org.pac4j.core.util.Pac4jConstants; import javax.annotation.Nullable; import java.io.ByteArrayInputStream; @@ -38,6 +38,7 @@ import java.io.IOException; import java.io.Serializable; import java.util.Map; +import java.util.Optional; import java.util.zip.GZIPInputStream; import java.util.zip.GZIPOutputStream; @@ -78,7 +79,7 @@ public String getOrCreateSessionId(WebContext context) @Nullable @Override - public Object get(WebContext context, String key) + public Optional get(WebContext context, String key) { final Cookie cookie = ContextHelper.getCookie(context, PAC4J_SESSION_PREFIX + key); Object value = null; @@ -86,7 +87,7 @@ public Object get(WebContext context, String key) value = uncompressDecryptBase64(cookie.getValue()); } LOGGER.debug("Get from session: [%s] = [%s]", key, value); - return value; + return Optional.ofNullable(value); } @Override @@ -142,7 +143,7 @@ private Serializable uncompressDecryptBase64(final String v) if (v != null && !v.isEmpty()) { byte[] bytes = StringUtils.decodeBase64String(v); if (bytes != null) { - return javaSerializationHelper.unserializeFromBytes(unCompress(cryptoService.decrypt(bytes))); + return javaSerializationHelper.deserializeFromBytes(unCompress(cryptoService.decrypt(bytes))); } } return null; @@ -176,19 +177,19 @@ private Object clearUserProfile(final Object value) { if (value instanceof Map) { final Map profiles = (Map) value; - profiles.forEach((name, profile) -> profile.clearSensitiveData()); + profiles.forEach((name, profile) -> profile.removeLoginData()); return profiles; } else { final CommonProfile profile = (CommonProfile) value; - profile.clearSensitiveData(); + profile.removeLoginData(); return profile; } } @Override - public SessionStore buildFromTrackableSession(WebContext arg0, Object arg1) + public Optional> buildFromTrackableSession(WebContext arg0, Object arg1) { - return null; + return Optional.empty(); } @Override @@ -198,9 +199,9 @@ public boolean destroySession(WebContext arg0) } @Override - public Object getTrackableSession(WebContext arg0) + public Optional getTrackableSession(WebContext arg0) { - return null; + return Optional.empty(); } @Override diff --git a/extensions-core/druid-pac4j/src/test/java/org/apache/druid/security/pac4j/Pac4jSessionStoreTest.java b/extensions-core/druid-pac4j/src/test/java/org/apache/druid/security/pac4j/Pac4jSessionStoreTest.java index 0349a98a7ccd..772bef7ef6c3 100644 --- a/extensions-core/druid-pac4j/src/test/java/org/apache/druid/security/pac4j/Pac4jSessionStoreTest.java +++ b/extensions-core/druid-pac4j/src/test/java/org/apache/druid/security/pac4j/Pac4jSessionStoreTest.java @@ -25,15 +25,23 @@ import org.junit.Test; import org.pac4j.core.context.Cookie; import org.pac4j.core.context.WebContext; +import org.pac4j.core.profile.CommonProfile; +import org.pac4j.core.profile.definition.CommonProfileDefinition; import java.util.Collections; +import java.util.HashMap; +import java.util.Map; +import java.util.Objects; +import java.util.Optional; public class Pac4jSessionStoreTest { + private static final String COOKIE_PASSPHRASE = "test-cookie-passphrase"; + @Test public void testSetAndGet() { - Pac4jSessionStore sessionStore = new Pac4jSessionStore("test-cookie-passphrase"); + Pac4jSessionStore sessionStore = new Pac4jSessionStore(COOKIE_PASSPHRASE); WebContext webContext1 = EasyMock.mock(WebContext.class); EasyMock.expect(webContext1.getScheme()).andReturn("https"); @@ -54,7 +62,73 @@ public void testSetAndGet() WebContext webContext2 = EasyMock.mock(WebContext.class); EasyMock.expect(webContext2.getRequestCookies()).andReturn(Collections.singletonList(cookie)); EasyMock.replay(webContext2); + Assert.assertEquals("value", Objects.requireNonNull(sessionStore.get(webContext2, "key")).orElse(null)); + } + + @Test + public void testSetAndGetClearUserProfile() + { + Pac4jSessionStore sessionStore = new Pac4jSessionStore(COOKIE_PASSPHRASE); + + WebContext webContext1 = EasyMock.mock(WebContext.class); + EasyMock.expect(webContext1.getScheme()).andReturn("https"); + Capture cookieCapture = EasyMock.newCapture(); + + webContext1.addResponseCookie(EasyMock.capture(cookieCapture)); + EasyMock.replay(webContext1); + + CommonProfile profile = new CommonProfile(); + profile.addAttribute(CommonProfileDefinition.DISPLAY_NAME, "name"); + sessionStore.set(webContext1, "pac4jUserProfiles", profile); + + Cookie cookie = cookieCapture.getValue(); + Assert.assertTrue(cookie.isSecure()); + Assert.assertTrue(cookie.isHttpOnly()); + Assert.assertTrue(cookie.isSecure()); + Assert.assertEquals(900, cookie.getMaxAge()); + + + WebContext webContext2 = EasyMock.mock(WebContext.class); + EasyMock.expect(webContext2.getRequestCookies()).andReturn(Collections.singletonList(cookie)); + EasyMock.replay(webContext2); + Optional value = sessionStore.get(webContext2, "pac4jUserProfiles"); + Assert.assertTrue(Objects.requireNonNull(value).isPresent()); + Assert.assertEquals("name", ((CommonProfile) value.get()).getAttribute(CommonProfileDefinition.DISPLAY_NAME)); + } + + @Test + public void testSetAndGetClearUserMultipleProfile() + { + Pac4jSessionStore sessionStore = new Pac4jSessionStore(COOKIE_PASSPHRASE); + + WebContext webContext1 = EasyMock.mock(WebContext.class); + EasyMock.expect(webContext1.getScheme()).andReturn("https"); + Capture cookieCapture = EasyMock.newCapture(); + + webContext1.addResponseCookie(EasyMock.capture(cookieCapture)); + EasyMock.replay(webContext1); - Assert.assertEquals("value", sessionStore.get(webContext2, "key")); + CommonProfile profile1 = new CommonProfile(); + profile1.addAttribute(CommonProfileDefinition.DISPLAY_NAME, "name1"); + CommonProfile profile2 = new CommonProfile(); + profile2.addAttribute(CommonProfileDefinition.DISPLAY_NAME, "name2"); + Map profiles = new HashMap<>(); + profiles.put("profile1", profile1); + profiles.put("profile2", profile2); + sessionStore.set(webContext1, "pac4jUserProfiles", profiles); + + Cookie cookie = cookieCapture.getValue(); + Assert.assertTrue(cookie.isSecure()); + Assert.assertTrue(cookie.isHttpOnly()); + Assert.assertTrue(cookie.isSecure()); + Assert.assertEquals(900, cookie.getMaxAge()); + + + WebContext webContext2 = EasyMock.mock(WebContext.class); + EasyMock.expect(webContext2.getRequestCookies()).andReturn(Collections.singletonList(cookie)); + EasyMock.replay(webContext2); + Optional value = sessionStore.get(webContext2, "pac4jUserProfiles"); + Assert.assertTrue(Objects.requireNonNull(value).isPresent()); + Assert.assertEquals(2, ((Map) value.get()).size()); } } diff --git a/licenses.yaml b/licenses.yaml index 1d5fe8c0d0d4..2d9fd869edaa 100644 --- a/licenses.yaml +++ b/licenses.yaml @@ -776,7 +776,7 @@ name: pac4j-oidc java security library license_category: binary module: extensions/druid-pac4j license_name: Apache License version 2.0 -version: 3.8.3 +version: 4.5.7 libraries: - org.pac4j: pac4j-oidc @@ -786,7 +786,7 @@ name: pac4j-core java security library license_category: binary module: extensions/druid-pac4j license_name: Apache License version 2.0 -version: 3.8.3 +version: 4.5.7 libraries: - org.pac4j: pac4j-core @@ -837,7 +837,7 @@ name: com.sun.mail javax.mail license_category: binary module: extensions/druid-pac4j license_name: CDDL 1.1 -version: 1.6.1 +version: 1.6.2 libraries: - com.sun.mail: javax.mail diff --git a/owasp-dependency-check-suppressions.xml b/owasp-dependency-check-suppressions.xml index 688baaddfcb7..12cabf7842b8 100644 --- a/owasp-dependency-check-suppressions.xml +++ b/owasp-dependency-check-suppressions.xml @@ -18,458 +18,139 @@ ~ under the License. --> + - - ^pkg:maven/org\.apache\.druid/druid\-indexing\-hadoop@.*$ - CVE-2012-4449 - CVE-2017-3162 - CVE-2018-8009 - CVE-2022-26612 - - - - - ^pkg:maven/org\.apache\.druid/druid\-processing@.*$ - CVE-2018-1000840 - - - - - ^pkg:maven/org\.apache\.jclouds\.api/openstack\-swift@.*$ - CVE-2013-7109 - CVE-2016-0737 - CVE-2016-0738 - CVE-2017-16613 - - - - ^pkg:maven/org\.apache\.jclouds\.api/openstack\-keystone@.*$ - - CVE-2015-7546 - CVE-2020-12689 - CVE-2020-12690 - CVE-2020-12691 - - - CVE-2021-3563 - - - - - ^pkg:maven/net\.minidev/json\-path@.*$ CVE-2022-45688 + CVE-2023-35116 - - ^pkg:maven/io\.kubernetes/client\-java.*@10.0.1$ - CVE-2020-8554 + file name: grpc-context-1.27.2.jar + ]]> + ^pkg:maven/io\.grpc/grpc-context@1.27.2$ + CVE-2023-4785 + CVE-2023-33953 + CVE-2023-32732 - - - - - ^pkg:maven/org\.hibernate/hibernate\-validator@.*$ - CVE-2017-7536 - CVE-2019-10219 - CVE-2019-14900 - CVE-2020-10693 - CVE-2020-25638 - - - - - ^pkg:maven/org\.codehaus\.jackson/jackson\-mapper\-asl@1.9.13$ - 10 - - + + - ^pkg:maven/io\.netty/netty@3.10.6.Final$ - CVE-2019-16869 - CVE-2019-20444 - CVE-2019-20445 - CVE-2020-11612 - CVE-2021-21290 - CVE-2021-21295 - CVE-2021-21409 - CVE-2021-37136 - CVE-2021-37137 - CVE-2021-43797 - CVE-2022-24823 - CVE-2022-41881 - CVE-2023-34462 - - - - - ^pkg:maven/com\.nimbusds/nimbus\-jose\-jwt@4.41.1$ - CVE-2019-17195 - - - - - ^pkg:maven/org\.apache\.directory\.server/apacheds\-i18n@.*$ - CVE-2020-7791 - - - - - ^pkg:maven/org\.apache\.thrift/libthrift@0.6.1$ - CVE-2016-5397 - CVE-2018-1320 - CVE-2019-0205 + file name: commons-compress-1.23.0.jar + ]]> + CVE-2023-42503 + - - ^pkg:maven/org\.codehaus\.jettison/jettison@1.*$ - CVE-2022-40149 - CVE-2022-40150 - CVE-2022-45685 - CVE-2022-45693 - CVE-2023-1436 + CVE-2020-8908 - - - - - CVE-2022-1471 - - CVE-2023-2251 - CVE-2022-3064 + + + ^pkg:maven/org\.codehaus\.plexus/plexus-interpolation@.*$ + CVE-2022-4244 + CVE-2022-4245 + + - ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-annotations@2.4.0$ - 10 + file name: maven-settings + ]]> + CVE-2021-26291 + + - ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-core@2.4.0$ - 10 + file name: derby-10.14.2.0.jar + ]]> + CVE-2022-46337 + - + - ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@2.4.0$ - CVE-2018-14721 - 10 + file name: jetty-servlets-9.4.53.v20231009.jar + ]]> + CVE-2023-36479 + - ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-.*@2.9.10$ - 10 + ^pkg:maven/com\.fasterxml\.jackson\.core/jackson\-databind@.*$ + + CVE-2022-42003 + CVE-2022-42004 - - - ^pkg:npm/node\-sass@.*$ - CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion') - - - - - ^pkg:maven/org\.apache\.kafka/kafka_2.11@2.0.0$ - CVE-2019-12399 - CVE-2018-17196 - - - - - ^pkg:maven/org\.apache\.kafka/kafka-clients@2.0.0$ - CVE-2019-12399 - CVE-2018-17196 - CVE-2023-25194 - - - - ^pkg:maven/org\.apache\.kafka/kafka\-clients@.*$ - CVE-2022-34917 - - + - ^pkg:maven/log4j/log4j@1.2.17$ - CVE-2019-17571 - CVE-2021-4104 - CVE-2020-9493 - CVE-2022-23307 - CVE-2022-23305 - CVE-2022-23302 - CVE-2023-26464 + file name: avatica-server-1.23.0.jar + ]]> + CVE-2022-36364 + CVE-2022-39135 + CVE-2020-13955 + + - ^pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1$ - CVE-2022-33915 - - - - CVE-2022-45855 - CVE-2022-42009 - - CVE-2022-25168 - CVE-2021-33036 + CVE-2023-33546 + - + - ^pkg:maven/io\.netty/netty@3.10.5.Final$ - CVE-2019-16869 - CVE-2019-20444 - CVE-2019-20445 - CVE-2021-37136 - CVE-2021-37137 - CVE-2021-4104 - CVE-2020-9493 - CVE-2022-23307 - CVE-2022-23305 - CVE-2022-23302 - CVE-2022-41881 - CVE-2020-11612 - - - - - ^pkg:maven/org\.apache\.hadoop/hadoop\-annotations@.*$ - CVE-2015-1776 - CVE-2016-3086 - CVE-2016-5393 - CVE-2016-6811 - CVE-2017-3162 - CVE-2018-11768 - CVE-2018-1296 - CVE-2018-8009 - CVE-2018-8029 + + CVE-2022-26612 + + CVE-2023-25613 + CVE-2023-2976 + + CVE-2023-1370 + CVE-2023-37475 + CVE-2023-39410 + CVE-2023-44487 + CVE-2023-36478 + + - CVE-2018-11765 - CVE-2020-9492 + file name: hadoop-*-3.3.1.jar + ]]> + CVE-2015-7430 + CVE-2017-3162 CVE-2021-31684 - CVE-2021-35517 - CVE-2021-35516 - CVE-2021-35515 - CVE-2021-36090 - CVE-2022-2048 CVE-2022-3509 CVE-2022-40152 - - - - CVE-2021-26291 - - - - - CVE-2020-13949 - - - - - ^pkg:maven/org\.codehaus\.jackson/jackson-(xc|jaxrs)@1.9.*$ - CVE-2018-14718 - CVE-2018-7489 - CVE-2022-42003 - CVE-2022-42004 - - - - - ^pkg:maven/org\.ini4j/ini4j@.*$ - CVE-2022-41404 - - - - - ^pkg:maven/org\.apache\.solr/solr-solrj@7.7.1$ - CVE-2020-13957 - CVE-2019-17558 - CVE-2019-0193 - CVE-2020-13941 - CVE-2021-29943 - CVE-2021-27905 - CVE-2021-29262 - CVE-2021-44548 - - - - - - ^pkg:maven/org\.jdom/jdom2@2.0.6$ - CVE-2021-33813 - - - - - - ^pkg:maven/org\.apache\.thrift/libthrift@0.13.0$ - CVE-2020-13949 - - CVE-2021-40531 - + CVE-2022-1278 + - - CVE-2020-8570 - CVE-2015-8559 - CVE-2021-20291 - CVE-2017-17485 - CVE-2018-5968 - CVE-2017-15095 - CVE-2019-16942 - CVE-2020-25649 - CVE-2020-35491 - CVE-2019-16943 - CVE-2020-35490 - CVE-2019-20330 - CVE-2020-10673 - CVE-2018-11307 - CVE-2018-7489 - CVE-2019-17267 - CVE-2019-17531 - CVE-2019-16335 - CVE-2019-14893 - CVE-2019-14540 - CVE-2021-37136 - CVE-2021-37137 + ^pkg:maven/org\.apache\.kafka/kafka\-clients@.*$ + CVE-2022-34917 + CVE-2023-25194 - - CVE-2015-7430 - CVE-2017-3162 + CVE-2023-34411 - + - - ^pkg:maven/org\.asynchttpclient/async-http-client-netty-utils@2.5.3$ - CVE-2021-43138 + file name: spatial4j-0.7.jar: + ]]> + CVE-2014-125074 - + + - ^pkg:maven/org\.asynchttpclient/async-http-client@2.5.3$ - CVE-2021-43138 + file name: jose4j-0.7.3.jar + ]]> + ^pkg:maven/org\.bitbucket\.b_c/jose4j@.*$ + CVE-2023-31582 - - - + - CVE-2022-45688 + CVE-2021-0341 + CVE-2016-2402 + CVE-2023-0833 - + - CVE-2022-25647 + ^pkg:maven/org\.codehaus\.jackson/jackson\-mapper\-asl@1.9.13$ + 10 - + - CVE-2021-32626 - CVE-2022-24735 + ^pkg:maven/io\.netty/netty@3.10.6.Final$ + CVE-2019-16869 + CVE-2019-20444 + CVE-2019-20445 + CVE-2020-11612 + CVE-2021-21290 + CVE-2021-21295 + CVE-2021-21409 + CVE-2021-37136 + CVE-2021-37137 + CVE-2021-43797 + CVE-2022-24823 + CVE-2022-41881 + CVE-2023-34462 - + - CVE-2021-44878 + ^pkg:maven/org\.apache\.thrift/libthrift@0.6.1$ + CVE-2018-1320 + CVE-2019-0205 - + - CVE-2020-17516 + file name: jettison-1.*.jar + ]]> + ^pkg:maven/org\.codehaus\.jettison/jettison@1.*$ + CVE-2022-40149 + CVE-2022-40150 + CVE-2022-45685 + CVE-2022-45693 + CVE-2023-1436 - + + + - CVE-2021-0341 - CVE-2016-2402 + file name: snakeyaml-1.33.jar + ]]> + CVE-2022-1471 + + CVE-2023-2251 + CVE-2022-3064 - - CVE-2021-41561 + file name: node-sass:4.13.1 + + The vulnerability is fixed in 4.13.1: https://github.com/sass/node-sass/issues/2816#issuecomment-575136455 + + But the dependency check plugin thinks it's still broken as the affected/fixed versions has not been updated on + Sonatype OSS Index: https://ossindex.sonatype.org/vuln/c97f4ae7-be1f-4f71-b238-7c095b126e74 + ]]> + ^pkg:npm/node\-sass@.*$ + CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion') - + - CVE-2022-36364 - CVE-2022-39135 + file name: jackson-xc-1.9.x.jar or jackson-jaxrs-1.9.x.jar + ]]> + ^pkg:maven/org\.codehaus\.jackson/jackson-(xc|jaxrs)@1.9.*$ + CVE-2018-14718 + CVE-2018-7489 + CVE-2022-42003 + CVE-2022-42004 + + + - ^pkg:maven/org\.apache\.calcite/calcite\-core@.*$ - CVE-2020-13955 + file name: libthrift-0.13.0.jar + ]]> + ^pkg:maven/org\.apache\.thrift/libthrift@.* + CVE-2020-13949 + - + - - CVE-2022-39135 + CVE-2022-25647 - + + + - - CVE-2022-39135 + CVE-2021-44878 @@ -671,65 +354,55 @@ - - ^pkg:npm/d3\-color@.*$ - 1084597 - - - ^pkg:npm/d3\-color@.*$ + 1084597 + + + + - ^pkg:maven/com\.google\.protobuf/protobuf\-java@.*$ - CVE-2022-3171 - - - ^pkg:maven/com\.google\.protobuf/protobuf\-java@.*$ + CVE-2022-3171 + + + + - ^pkg:maven/com\.google\.protobuf/protobuf\-java\-util@.*$ - CVE-2022-3171 - - - ^pkg:maven/com\.google\.protobuf/protobuf\-java\-util@.*$ + CVE-2022-3171 + + + + - ^pkg:npm/ansi\-regex@.*$ - 1084697 - CVE-2021-3807 - - - ^pkg:npm/ansi\-regex@.*$ + 1084697 + CVE-2021-3807 + + + + - ^pkg:npm/glob\-parent@.*$ - 1081884 - CVE-2020-28469 - - - - ^pkg:npm/minimatch@.*$ - 1084765 - - - - ^pkg:npm/y18n@.*$ - 1070209 - CVE-2020-7774 - + ^pkg:npm/glob\-parent@.*$ + 1081884 + CVE-2020-28469 + + - - - CVE-2022-45048 + ^pkg:npm/minimatch@.*$ + 1084765 + CVE-2023-44487 CVE-2023-36478 + prototype pollution CVE-2020-28458 - - - ^pkg:maven/org\.apache\.ranger/ranger\-plugins\-.*@2.0.0$ - - CVE-2021-40331 - + @@ -775,24 +442,15 @@ CVE-2021-4277 - + - ^pkg:maven/com\.squareup\.okio/okio@1..*$ + ^pkg:maven/com\.squareup\.okio/okio@..*$ CVE-2023-3635 - - - ^pkg:maven/io\.grpc/grpc-context@1.27.2$ - CVE-2023-4785 - CVE-2023-33953 - - ^pkg:maven/org\.codehaus\.plexus/plexus-interpolation@.*$ @@ -805,18 +463,6 @@ CVE-2023-5072 - - - - CVE-2023-44981 - + + + + ^pkg:maven/org\.apache\.thrift/libthrift@.*$ + CVE-2016-5397 + CVE-2018-1320 + CVE-2019-0205 + CVE-2015-3254 + + + + + CVE-2012-6708 + CVE-2015-9251 + CVE-2019-11358 + CVE-2020-11022 + CVE-2020-11023 + CVE-2020-7656 + CVE-2011-4969 + CVE-2020-17516 + CVE-2020-13946 + + + + + + + CVE-2020-12689 + CVE-2020-12691 + CVE-2020-12690 + CVE-2021-3563 + CVE-2016-0738 + CVE-2017-16613 + + + + + + + + CVE-2023-46120 + + + + + + + + ^pkg:maven/org\.apache\.hadoop/hadoop\-annotations@.*$ + CVE-2015-1776 + CVE-2016-3086 + CVE-2016-5393 + CVE-2016-6811 + CVE-2017-3162 + CVE-2018-11768 + CVE-2018-1296 + CVE-2018-8009 + CVE-2018-8029 + + + + - CVE-2023-31582 + ^pkg:maven/log4j/log4j@1.2.17$ + CVE-2019-17571 + CVE-2021-4104 + CVE-2020-9493 + CVE-2022-23307 + CVE-2022-23305 + CVE-2022-23302 + CVE-2023-26464 - - CVE-2022-46337 + + + ^pkg:maven/io\.netty/netty@3.10.5.Final$ + CVE-2019-16869 + CVE-2019-20444 + CVE-2019-20445 + CVE-2021-37136 + CVE-2021-37137 + CVE-2021-4104 + CVE-2020-9493 + CVE-2022-23307 + CVE-2022-23305 + CVE-2022-23302 + CVE-2022-41881 + CVE-2020-11612 + + + + + CVE-2022-45855 + CVE-2022-42009 + + CVE-2022-25168 + CVE-2021-33036 + CVE-2020-9492 + + + + + + + + ^pkg:maven/org\.ini4j/ini4j@.*$ + CVE-2022-41404 + + + + + + ^pkg:maven/org\.jdom/jdom2@2.0.6$ + CVE-2021-33813 + + + + + + + + CVE-2016-5397 + CVE-2018-1320 + CVE-2019-0210 + CVE-2020-13949 + CVE-2019-0205 + CVE-2019-0210 + CVE-2020-13949 - + \ No newline at end of file