Uploaded image for project: 'Flume'
  1. Flume
  2. FLUME-3132

Upgrade tomcat jasper library dependencies

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: 1.7.0
    • Fix Version/s: 1.8.0
    • Component/s: None
    • Labels:

      Description

      Group Artifact Version used Upgrade target
      tomcat jasper-compiler 5.5.23 8.5.x
      tomcat jasper-runtime 5.5.23 8.5.x

      Security vulnerability:

      Note: These artifacts were moved to:

      • New Group org.apache.tomcat
      • New Artifact

      Please do:

      • CVE might be a false alarm or mistake. Please double check.
      • double check the newest version.
      • consider to remove a dependency if better alternative is available.
      • check whether the lib change would introduce a backward incompatibility (in which case please add this label `breaking_change` and fix version should be the next major)

      Excerpt from mvn dependency:tree

      org.apache.flume:flume-ng-auth:jar:1.8.0-SNAPSHOT
      +- org.apache.hadoop:hadoop-common:jar:2.4.0:compile
      |  +- tomcat:jasper-compiler:jar:5.5.23:runtime
      |  +- tomcat:jasper-runtime:jar:5.5.23:runtime
      

        Issue Links

          Activity

          Hide
          hudson Hudson added a comment -

          UNSTABLE: Integrated in Jenkins build Flume-trunk-hbase-1 #311 (See https://builds.apache.org/job/Flume-trunk-hbase-1/311/)
          FLUME-3132. Upgrade tomcat jasper library dependencies (denes: http://git-wip-us.apache.org/repos/asf/flume/repo?p=flume.git&a=commit&h=0cc7542ddc18239754befb19408dc3aca4337a66)

          • (edit) pom.xml
          Show
          hudson Hudson added a comment - UNSTABLE: Integrated in Jenkins build Flume-trunk-hbase-1 #311 (See https://builds.apache.org/job/Flume-trunk-hbase-1/311/ ) FLUME-3132 . Upgrade tomcat jasper library dependencies (denes: http://git-wip-us.apache.org/repos/asf/flume/repo?p=flume.git&a=commit&h=0cc7542ddc18239754befb19408dc3aca4337a66 ) (edit) pom.xml
          Hide
          denes Denes Arvay added a comment -

          Thank you Ferenc Szabo for the patch, Miklos Csanady and Attila Simon for the review, I have pushed the change to trunk.

          Show
          denes Denes Arvay added a comment - Thank you Ferenc Szabo for the patch, Miklos Csanady and Attila Simon for the review, I have pushed the change to trunk.
          Hide
          githubbot ASF GitHub Bot added a comment -

          Github user asfgit closed the pull request at:

          https://github.com/apache/flume/pull/152

          Show
          githubbot ASF GitHub Bot added a comment - Github user asfgit closed the pull request at: https://github.com/apache/flume/pull/152
          Hide
          jira-bot ASF subversion and git services added a comment -

          Commit 0cc7542ddc18239754befb19408dc3aca4337a66 in flume's branch refs/heads/trunk from Ferenc Szabo
          [ https://git-wip-us.apache.org/repos/asf?p=flume.git;h=0cc7542 ]

          FLUME-3132. Upgrade tomcat jasper library dependencies

          Exclude the vulnerable jasper library transitive dependencies from hadoop, hbase
          dependencies.

          This closes #152

          Reviewers: Attila Simon, Miklos Csanady

          (Ferenc Szabo via Denes Arvay)

          Show
          jira-bot ASF subversion and git services added a comment - Commit 0cc7542ddc18239754befb19408dc3aca4337a66 in flume's branch refs/heads/trunk from Ferenc Szabo [ https://git-wip-us.apache.org/repos/asf?p=flume.git;h=0cc7542 ] FLUME-3132 . Upgrade tomcat jasper library dependencies Exclude the vulnerable jasper library transitive dependencies from hadoop, hbase dependencies. This closes #152 Reviewers: Attila Simon, Miklos Csanady (Ferenc Szabo via Denes Arvay)
          Hide
          githubbot ASF GitHub Bot added a comment -

          GitHub user szaboferee opened a pull request:

          https://github.com/apache/flume/pull/152

          FLUME-3132 Upgrade tomcat jasper library dependencies

          excluding vulnerable dependencies

          You can merge this pull request into a Git repository by running:

          $ git pull https://github.com/szaboferee/flume FLUME-3132

          Alternatively you can review and apply these changes as the patch at:

          https://github.com/apache/flume/pull/152.patch

          To close this pull request, make a commit to your master/trunk branch
          with (at least) the following in the commit message:

          This closes #152


          commit ed60c294005ba1bb46b86d8f62ddc0d655efca3b
          Author: Ferenc Szabo <fszabo@cloudera.com>
          Date: 2017-08-14T16:34:33Z

          FLUME-3132 Upgrade tomcat jasper library dependencies

          excluding vulnerable dependencies


          Show
          githubbot ASF GitHub Bot added a comment - GitHub user szaboferee opened a pull request: https://github.com/apache/flume/pull/152 FLUME-3132 Upgrade tomcat jasper library dependencies excluding vulnerable dependencies You can merge this pull request into a Git repository by running: $ git pull https://github.com/szaboferee/flume FLUME-3132 Alternatively you can review and apply these changes as the patch at: https://github.com/apache/flume/pull/152.patch To close this pull request, make a commit to your master/trunk branch with (at least) the following in the commit message: This closes #152 commit ed60c294005ba1bb46b86d8f62ddc0d655efca3b Author: Ferenc Szabo <fszabo@cloudera.com> Date: 2017-08-14T16:34:33Z FLUME-3132 Upgrade tomcat jasper library dependencies excluding vulnerable dependencies
          Hide
          sati Attila Simon added a comment -

          Hi Ferenc Szabo,
          Thank you for looking into this. Indeed it is included as a transitive dependency via hadoop-common only. As long as we understand the exact impact I'm fine with either case. Within our company we ship flume with a slightly enhanced hadoop-common:2.6.0 so I cannot help you saying that 2.7.0 will be fine for sure so that has to be heavily verified. By writing this it looks like that upgrading hadoop-common would be a longer and separate task thus should deserve a separate jira (and close this one once that has been resolved). I guess impact of exclusion has a pretty limited scope so sounds easier to me, but essentially it is your call which way to go.

          Show
          sati Attila Simon added a comment - Hi Ferenc Szabo , Thank you for looking into this. Indeed it is included as a transitive dependency via hadoop-common only. As long as we understand the exact impact I'm fine with either case. Within our company we ship flume with a slightly enhanced hadoop-common:2.6.0 so I cannot help you saying that 2.7.0 will be fine for sure so that has to be heavily verified. By writing this it looks like that upgrading hadoop-common would be a longer and separate task thus should deserve a separate jira (and close this one once that has been resolved). I guess impact of exclusion has a pretty limited scope so sounds easier to me, but essentially it is your call which way to go.
          Hide
          fszabo Ferenc Szabo added a comment -

          I am afraid that this version upgrade is not possible, because the dependency comes with hadoop-common and the jasper artifacts moved to a different group with a different artifactId.

          https://mvnrepository.com/artifact/tomcat/jasper-compiler
          ->
          https://mvnrepository.com/artifact/org.apache.tomcat/tomcat-jasper

          We have the latest version possible.

          We can increase the hadoop-common version to get rid of jasper from the 2.7.0 there is no jasper lib.
          However with hadoop-common version upgrade we would have a lot of other dependency change.

          Should we go with the new hadoop-common or with excluding the jasper from the dependencies, because it looks like we do not need them.

          Show
          fszabo Ferenc Szabo added a comment - I am afraid that this version upgrade is not possible, because the dependency comes with hadoop-common and the jasper artifacts moved to a different group with a different artifactId. https://mvnrepository.com/artifact/tomcat/jasper-compiler -> https://mvnrepository.com/artifact/org.apache.tomcat/tomcat-jasper We have the latest version possible. We can increase the hadoop-common version to get rid of jasper from the 2.7.0 there is no jasper lib. However with hadoop-common version upgrade we would have a lot of other dependency change. Should we go with the new hadoop-common or with excluding the jasper from the dependencies, because it looks like we do not need them.

            People

            • Assignee:
              fszabo Ferenc Szabo
              Reporter:
              sati Attila Simon
            • Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development