Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CVE] Fix CVE-2021-20250 (jboss-remoting) #2555

Merged
merged 2 commits into from
Feb 24, 2025
Merged

[CVE] Fix CVE-2021-20250 (jboss-remoting) #2555

merged 2 commits into from
Feb 24, 2025

Conversation

LightGuard
Copy link
Member

Issue in the remoting code that we're putting in from JBoss. EAP 7.4.20 is using wildfly, so aligning with that version.

@LightGuard
Copy link
Member Author

Glad this one went green.

@baldimir
Copy link
Member

baldimir commented Feb 7, 2025

jenkins run cdb

@baldimir
Copy link
Member

baldimir commented Feb 7, 2025

jenkins run fdb

@LightGuard
Copy link
Member Author

These look like the repo died, or didn't allow connections. Do we try it again?

@baldimir
Copy link
Member

jenkins run cdb

@baldimir
Copy link
Member

jenkins run fdb

@baldimir
Copy link
Member

@LightGuard yes, I see a lot of similar problems with the Node proxy in the jobs. I restarted.

@baldimir
Copy link
Member

baldimir commented Feb 10, 2025 •
edited
Loading

@LightGuard There is some problem in jbpm repository. Please see the compile downstream fail here:

[2025-02-10T10:34:36.781Z] [ERROR] [ERROR] Some problems were encountered while processing the POMs:
[2025-02-10T10:34:36.781Z] [ERROR] 'dependencies.dependency.version' for org.jboss:jboss-remote-naming:jar must be a valid version but is '${version.org.jboss.remote-naming}'. @ org.kie:kie-parent:7.67.2-SNAPSHOT, /home/jenkins/.m2/repository/org/kie/kie-parent/7.67.2-SNAPSHOT/kie-parent-7.67.2-SNAPSHOT.pom, line 4647, column 18
[2025-02-10T10:34:36.781Z] [ERROR] 'dependencies.dependency.version' for org.jboss:jboss-remote-naming:jar must be a valid version but is '${version.org.jboss.remote-naming}'. @ org.kie:kie-parent:7.67.2-SNAPSHOT, /home/jenkins/.m2/repository/org/kie/kie-parent/7.67.2-SNAPSHOT/kie-parent-7.67.2-SNAPSHOT.pom, line 4647, column 18
[2025-02-10T10:34:36.781Z]  @ 
[2025-02-10T10:34:36.781Z] [ERROR] The build could not read 2 projects -> [Help 1]
[2025-02-10T10:34:36.781Z] org.apache.maven.project.ProjectBuildingException: Some problems were encountered while processing the POMs:
[2025-02-10T10:34:36.781Z] [ERROR] 'dependencies.dependency.version' for org.jboss:jboss-remote-naming:jar must be a valid version but is '${version.org.jboss.remote-naming}'. @ org.kie:kie-parent:7.67.2-SNAPSHOT, /home/jenkins/.m2/repository/org/kie/kie-parent/7.67.2-SNAPSHOT/kie-parent-7.67.2-SNAPSHOT.pom, line 4647, column 18
[2025-02-10T10:34:36.781Z] [ERROR] 'dependencies.dependency.version' for org.jboss:jboss-remote-naming:jar must be a valid version but is '${version.org.jboss.remote-naming}'. @ org.kie:kie-parent:7.67.2-SNAPSHOT, /home/jenkins/.m2/repository/org/kie/kie-parent/7.67.2-SNAPSHOT/kie-parent-7.67.2-SNAPSHOT.pom, line 4647, column 18
[2025-02-10T10:34:36.781Z] 
[2025-02-10T10:34:36.781Z]     at org.apache.maven.project.DefaultProjectBuilder.build (DefaultProjectBuilder.java:397)
[2025-02-10T10:34:36.781Z]     at org.apache.maven.graph.DefaultGraphBuilder.collectProjects (DefaultGraphBuilder.java:414)
[2025-02-10T10:34:36.781Z]     at org.apache.maven.graph.DefaultGraphBuilder.getProjectsForMavenReactor (DefaultGraphBuilder.java:405)
[2025-02-10T10:34:36.781Z]     at org.apache.maven.graph.DefaultGraphBuilder.build (DefaultGraphBuilder.java:82)
[2025-02-10T10:34:36.781Z]     at org.apache.maven.DefaultMaven.buildGraph (DefaultMaven.java:507)
[2025-02-10T10:34:36.781Z]     at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:219)
[2025-02-10T10:34:36.781Z]     at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
[2025-02-10T10:34:36.781Z]     at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
[2025-02-10T10:34:36.781Z]     at org.apache.maven.cli.MavenCli.execute (MavenCli.java:957)
[2025-02-10T10:34:36.781Z]     at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:289)
[2025-02-10T10:34:36.781Z]     at org.apache.maven.cli.MavenCli.main (MavenCli.java:193)
[2025-02-10T10:34:36.781Z]     at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
[2025-02-10T10:34:36.781Z]     at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
[2025-02-10T10:34:36.781Z]     at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
[2025-02-10T10:34:36.781Z]     at java.lang.reflect.Method.invoke (Method.java:566)
[2025-02-10T10:34:36.781Z]     at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:282)
[2025-02-10T10:34:36.781Z]     at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:225)
[2025-02-10T10:34:36.781Z]     at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:406)
[2025-02-10T10:34:36.781Z]     at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:347)
[2025-02-10T10:34:36.781Z] [ERROR]   
[2025-02-10T10:34:36.781Z] [ERROR]   The project org.jbpm:jbpm-container-test-suite:7.67.2-SNAPSHOT (/home/jenkins/workspace/KIE/7.67.x-blue/compile/droolsjbpm-build-bootstrap-7.67.x-blue.compile/bc/kiegroup_jbpm/jbpm-container-test/jbpm-in-container-test/jbpm-container-test-suite/pom.xml) has 1 error
[2025-02-10T10:34:36.781Z] [ERROR]     'dependencies.dependency.version' for org.jboss:jboss-remote-naming:jar must be a valid version but is '${version.org.jboss.remote-naming}'. @ org.kie:kie-parent:7.67.2-SNAPSHOT, /home/jenkins/.m2/repository/org/kie/kie-parent/7.67.2-SNAPSHOT/kie-parent-7.67.2-SNAPSHOT.pom, line 4647, column 18
[2025-02-10T10:34:36.781Z] [ERROR]   
[2025-02-10T10:34:36.781Z] [ERROR]   The project org.jbpm:jbpm-remote-ejb-test-suite:7.67.2-SNAPSHOT (/home/jenkins/workspace/KIE/7.67.x-blue/compile/droolsjbpm-build-bootstrap-7.67.x-blue.compile/bc/kiegroup_jbpm/jbpm-container-test/jbpm-remote-ejb-test/jbpm-remote-ejb-test-suite/pom.xml) has 1 error
[2025-02-10T10:34:36.781Z] [ERROR]     'dependencies.dependency.version' for org.jboss:jboss-remote-naming:jar must be a valid version but is '${version.org.jboss.remote-naming}'. @ org.kie:kie-parent:7.67.2-SNAPSHOT, /home/jenkins/.m2/repository/org/kie/kie-parent/7.67.2-SNAPSHOT/kie-parent-7.67.2-SNAPSHOT.pom, line 4647, column 18
[2025-02-10T10:34:36.781Z] [ERROR] 
[2025-02-10T10:34:36.781Z] [ERROR] Re-run Maven using the -X switch to enable full debug logging.
[2025-02-10T10:34:36.782Z] [ERROR] 
[2025-02-10T10:34:36.782Z] [ERROR] For more information about the errors and possible solutions, please read the following articles:
[2025-02-10T10:34:36.782Z] [ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/ProjectBuildingException

@LightGuard LightGuard mentioned this pull request Feb 11, 2025
Closed
@LightGuard
Copy link
Member Author

jenkins run fdb

@baldimir
Copy link
Member

jenkins run cdb

@LightGuard
Copy link
Member Author

Well... Build chain worked, and the Jenkins pull request worked, but not the others.

@LightGuard
Copy link
Member Author

jenkins run cdb

@baldimir
Copy link
Member

There are these test failures in the full downstream build. All with the same error:
Screenshot 2025-02-12 at 12 35 01

@LightGuard
Fixing CVE-2021-20250
6985e02 
Updating remoting to wildfly version used in EAP 7.4.20

Signed-off-by: Jason Porter <[email protected]>
@baldimir
Copy link
Member

jenkins run cdb

@baldimir
Copy link
Member

jenkins run fdb

@baldimir
Copy link
Member

Here are the last test failures:
Screenshot 2025-02-18 at 13 03 28
Screenshot 2025-02-18 at 13 03 50

@LightGuard
Going back to jboss-remoting
892f357 
Signed-off-by: Jason Porter <[email protected]>
@LightGuard
Copy link
Member Author

jenkins run fdb

@LightGuard LightGuard changed the title [CVE] Fix CVE-2021-20250 [CVE] Fix CVE-2021-20250 (jboss-remoting) Feb 19, 2025
@LightGuard
Copy link
Member Author

jenkins run cdb

1 similar comment
@LightGuard
Copy link
Member Author

jenkins run cdb

@LightGuard
Copy link
Member Author

jenkins run fdb

@baldimir
Copy link
Member

baldimir commented Feb 24, 2025 •
edited
Loading

Failures in full downstream build are unrelated.

@baldimir baldimir merged commit b40bbca into kiegroup:7.67.x-blue Feb 24, 2025
3 of 5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@baldimir baldimir Awaiting requested review from baldimir

@jstastny-cz jstastny-cz Awaiting requested review from jstastny-cz

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@LightGuard @baldimir