#67: Fix CVE-2023-42503 in org.apache.commons:commons-compress

.gitattributes

@@ -5,6 +5,7 @@ doc/changes/changelog.md                                         linguist-genera
 .github/workflows/dependencies_check.yml                         linguist-generated=true
 .github/workflows/ci-build-next-java.yml                         linguist-generated=true
 .github/workflows/release_droid_print_quick_checksum.yml         linguist-generated=true
+.github/workflows/release_droid_release_on_maven_central.yml     linguist-generated=true
 .github/workflows/release_droid_upload_github_release_assets.yml linguist-generated=true
 cloudSetup/.terraform.lock.hcl                                   linguist-generated=true
 

.github/workflows/ci-build.yml

@@ -14,15 +14,21 @@ jobs:
       group: ${{ github.workflow }}-${{ github.ref }}
       cancel-in-progress: true
     steps:
+      - name: Free Disk Space
+        run: |
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /usr/share/dotnet
       - name: Checkout the repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Set up JDK 11
+      - name: Set up JDK 11 & 17
         uses: actions/setup-java@v3
         with:
           distribution: "temurin"
-          java-version: 11
+          java-version: |
+            17
+            11
           cache: "maven"
       - name: Cache SonarCloud packages
         uses: actions/cache@v3
@@ -49,7 +55,7 @@ jobs:
           DEPUTY: ${{ secrets.AWS_TAG_DEPUTY }}
       - name: Run tests and build with Maven
         run: |
-          mvn --batch-mode clean verify \
+          JAVA_HOME=$JAVA_HOME_11_X64 mvn --batch-mode clean verify \
               -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \
               -DtrimStackTrace=false
       - name: Publish Test Report
@@ -60,12 +66,12 @@ jobs:
       - name: Sonar analysis
         if: ${{ env.SONAR_TOKEN != null }}
         run: |
-          mvn --batch-mode org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
+          JAVA_HOME=$JAVA_HOME_17_X64 mvn --batch-mode org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \
               -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \
               -DtrimStackTrace=false \
               -Dsonar.organization=exasol \
               -Dsonar.host.url=https://sonarcloud.io \
-              -Dsonar.login=$SONAR_TOKEN
+              -Dsonar.token=$SONAR_TOKEN
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/release_droid_prepare_original_checksum.yml

@@ -8,8 +8,12 @@ jobs:
     runs-on: ubuntu-latest
     environment: aws
     steps:
+      - name: Free Disk Space
+        run: |
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /usr/share/dotnet
       - name: Checkout the repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up JDK 11

.project-keeper.yml

@@ -8,5 +8,3 @@ excludes:
   - "E-PK-CORE-18: Outdated content: '.github/workflows/ci-build.yml'"
   - "E-PK-CORE-18: Outdated content: '.github/workflows/release_droid_prepare_original_checksum.yml'"
 linkReplacements:
-  - https://github.com/eclipse-ee4j/parsson/parsson|https://github.com/eclipse-ee4j/parsson
-  - https://netty.io/netty-handler/|https://netty.io/

doc/changes/changes_2.0.4.md

@@ -0,0 +1,33 @@
+# Exasol Test Setup Abstraction Java 2.0.4, released 2023-09-26
+
+Code name: Fix CVE-2023-42503
+
+## Summary
+
+This release fixes CVE-2023-42503 in `org.apache.commons:commons-compress`. 
+
+The release also updates the default Exasol DB version to 7.1.23.
+
+**Known issue:** Transitive dependency `io.netty:netty-handler` (via `software.amazon.awssdk:cloudformation`) still contains CVE-2023-4586. See [issue #65](https://github.com/exasol/exasol-test-setup-abstraction-java/issues/65) for details.
+
+## Security
+
+* #67 Fixed CVE-2023-42503 in `org.apache.commons:commons-compress`
+
+## Dependency Updates
+
+### Compile Dependency Updates
+
+* Updated `com.exasol:exasol-testcontainers:6.6.1` to `6.6.2`
+* Updated `software.amazon.awssdk:cloudformation:2.20.137` to `2.20.153`
+* Updated `software.amazon.awssdk:ec2:2.20.137` to `2.20.153`
+
+### Test Dependency Updates
+
+* Updated `nl.jqno.equalsverifier:equalsverifier:3.15.1` to `3.15.2`
+* Updated `org.slf4j:slf4j-jdk14:2.0.7` to `2.0.9`
+
+### Plugin Dependency Updates
+
+* Updated `com.exasol:project-keeper-maven-plugin:2.9.11` to `2.9.12`
+* Updated `org.basepom.maven:duplicate-finder-maven-plugin:1.5.1` to `2.0.1`

pom.xml

@@ -2,13 +2,13 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <artifactId>exasol-test-setup-abstraction-java</artifactId>
-    <version>2.0.3</version>
+    <version>2.0.4</version>
     <name>exasol-test-setup-abstraction-java</name>
     <description>Common interface for testing with an exasol database local and on AWS using Java.</description>
     <url>https://github.com/exasol/exasol-test-setup-abstraction-java/</url>
     <properties>
         <junit.version>5.10.0</junit.version>
-        <awssdk.version>2.20.137</awssdk.version>
+        <awssdk.version>2.20.153</awssdk.version>
     </properties>
     <dependencyManagement>
         <dependencies>
@@ -30,8 +30,9 @@
         <dependency>
             <groupId>com.exasol</groupId>
             <artifactId>exasol-testcontainers</artifactId>
-            <version>6.6.1</version>
+            <version>6.6.2</version>
         </dependency>
+        <!-- Required for ExaOperationGateway -->
         <dependency>
             <groupId>fr.turri</groupId>
             <artifactId>aXMLRPC</artifactId>
@@ -95,7 +96,7 @@
         <dependency>
             <groupId>nl.jqno.equalsverifier</groupId>
             <artifactId>equalsverifier</artifactId>
-            <version>3.15.1</version>
+            <version>3.15.2</version>
             <scope>test</scope>
         </dependency>
         <dependency>
@@ -108,7 +109,7 @@
             <!-- Enable log output from testcontainers in integration tests -->
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-jdk14</artifactId>
-            <version>2.0.7</version>
+            <version>2.0.9</version>
             <scope>test</scope>
         </dependency>
     </dependencies>
@@ -134,7 +135,7 @@
             <plugin>
                 <groupId>com.exasol</groupId>
                 <artifactId>project-keeper-maven-plugin</artifactId>
-                <version>2.9.11</version>
+                <version>2.9.12</version>
                 <executions>
                     <execution>
                         <goals>
@@ -146,7 +147,7 @@
             <plugin>
                 <groupId>org.basepom.maven</groupId>
                 <artifactId>duplicate-finder-maven-plugin</artifactId>
-                <version>1.5.1</version>
+                <version>2.0.1</version>
                 <executions>
                     <execution>
                         <id>default</id>
@@ -174,7 +175,7 @@
     <parent>
         <artifactId>exasol-test-setup-abstraction-java-generated-parent</artifactId>
         <groupId>com.exasol</groupId>
-        <version>2.0.3</version>
+        <version>2.0.4</version>
         <relativePath>pk_generated_parent.pom</relativePath>
     </parent>
 </project>

src/main/java/com/exasol/exasoltestsetup/testcontainers/ExasolTestcontainerTestSetup.java

@@ -22,7 +22,7 @@
  */
 public class ExasolTestcontainerTestSetup implements ExasolTestSetup {
     private static final int SSH_PORT = 22;
-    private final ExasolContainer<? extends ExasolContainer<?>> exasolContainer = new ExasolContainer<>("7.1.22")
+    private final ExasolContainer<? extends ExasolContainer<?>> exasolContainer = new ExasolContainer<>("7.1.23")
             .withReuse(true);
     private final SshConnection sshConnection;
     private final KeyPair keyPair;