[
https://issues.apache.org/jira/browse/CASSANDRA-21676?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Éder Costa updated CASSANDRA-21676:
-----------------------------------
Description:
Cassandra depends on org.apache.cassandra:cassandra-driver-core:3.12.1 with the
"shaded" classifier. That artifact bundles a relocated copy of Netty
4.1.94.Final (released 2023-06-20) under com.datastax.shaded.netty, across
eight Netty modules. Twelve published Netty advisories fall inside that
version, ten of them in netty-handler and netty-codec.
The bigger problem is that this copy is invisible to dependency scanners. The
driver's shade configuration uses DontIncludeResourceTransformer to delete the
Maven descriptors of the bundled libraries, including netty-handler and
netty-codec. Three descriptors were not listed and therefore survive:
netty-resolver, netty-transport-classes-epoll and
netty-transport-native-unix-common. Those three carry no advisory at all, so
scanners report a clean result while the modules that matter cannot be
detected. Consumers cannot work around this with a Maven exclusion, since an
exclusion matches an artifact coordinate and these relocated classes were never
published as an artifact.
Reproduction:
curl -sO
[https://repo1.maven.org/maven2/org/apache/cassandra/cassandra-driver-core/3.12.1/c|https://repo1.maven.org/maven2/org/apache/cassandra/cassandra-driver-core/3.12.1/cassandra-driver-core-3.12.1-shaded.jar]
[assandra-driver-core-3.12.1-shaded.jar|https://repo1.maven.org/maven2/org/apache/cassandra/cassandra-driver-core/3.12.1/cassandra-driver-core-3.12.1-shaded.jar]
# surviving descriptor shows the bundled version
unzip -p cassandra-driver-core-3.12.1-shaded.jar
META-INF/maven/io.netty/netty-resolver/pom.properties
# -> version=4.1.94.Final
# netty-handler has no descriptor, but its classes are there
unzip -l cassandra-driver-core-3.12.1-shaded.jar
'META-INF/maven/io.netty/netty-handler/pom.*'
unzip -l cassandra-driver-core-3.12.1-shaded.jar
'com/datastax/shaded/netty/handler/ssl/SslClientHelloHandler.class'
Related: CASSANDRA-19654 (update the bundled driver dependency, open since
2024-05-22) and CASSANDRA-20329 (move the driver to a tools-only dependency).
was:
Cassandra depends on org.apache.cassandra:cassandra-driver-core:3.12.1 with the
"shaded" classifier. That artifact bundles a relocated copy of Netty
4.1.94.Final (released 2023-06-20) under com.datastax.shaded.netty, across
eight Netty modules. Twelve published Netty advisories fall inside that
version, ten of them in netty-handler and netty-codec.
The bigger problem is that this copy is invisible to dependency scanners. The
driver's shade configuration uses DontIncludeResourceTransformer to delete the
Maven descriptors of the bundled libraries, including netty-handler and
netty-codec. Three descriptors were not listed and therefore survive:
netty-resolver, netty-transport-classes-epoll and
netty-transport-native-unix-common. Those three carry no advisory at all, so
scanners report a clean result while the modules that matter cannot be
detected. Consumers cannot work around this with a Maven exclusion, since an
exclusion matches an artifact coordinate and these relocated classes were never
published as an artifact.
Reproduction:
curl -sO
https://repo1.maven.org/maven2/org/apache/cassandra/cassandra-driver-core/3.12.1/cassandra-driver-core-3.12.1-shaded.jar
# surviving descriptor shows the bundled version
unzip -p cassandra-driver-core-3.12.1-shaded.jar
META-INF/maven/io.netty/netty-resolver/pom.properties
# -> version=4.1.94.Final
# netty-handler has no descriptor, but its classes are there
unzip -l cassandra-driver-core-3.12.1-shaded.jar
'META-INF/maven/io.netty/netty-handler/pom.*'
unzip -l cassandra-driver-core-3.12.1-shaded.jar
'com/datastax/shaded/netty/handler/ssl/SslClientHelloHandler.class'
Related: CASSANDRA-19654 (update the bundled driver dependency, open since
2024-05-22) and CASSANDRA-20329 (move the driver to a tools-only dependency).
> Shaded cassandra-driver-core bundles Netty 4.1.94.Final and hides it from
> security scanners
> -------------------------------------------------------------------------------------------
>
> Key: CASSANDRA-21676
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21676
> Project: Apache Cassandra
> Issue Type: Bug
> Components: Dependencies
> Reporter: Éder Costa
> Priority: Normal
> Labels: SECURITY, security, security-issue
>
> Cassandra depends on org.apache.cassandra:cassandra-driver-core:3.12.1 with
> the "shaded" classifier. That artifact bundles a relocated copy of Netty
> 4.1.94.Final (released 2023-06-20) under com.datastax.shaded.netty, across
> eight Netty modules. Twelve published Netty advisories fall inside that
> version, ten of them in netty-handler and netty-codec.
> The bigger problem is that this copy is invisible to dependency scanners. The
> driver's shade configuration uses DontIncludeResourceTransformer to delete
> the Maven descriptors of the bundled libraries, including netty-handler and
> netty-codec. Three descriptors were not listed and therefore survive:
> netty-resolver, netty-transport-classes-epoll and
> netty-transport-native-unix-common. Those three carry no advisory at all, so
> scanners report a clean result while the modules that matter cannot be
> detected. Consumers cannot work around this with a Maven exclusion, since an
> exclusion matches an artifact coordinate and these relocated classes were
> never published as an artifact.
> Reproduction:
> curl -sO
> [https://repo1.maven.org/maven2/org/apache/cassandra/cassandra-driver-core/3.12.1/c|https://repo1.maven.org/maven2/org/apache/cassandra/cassandra-driver-core/3.12.1/cassandra-driver-core-3.12.1-shaded.jar]
>
> [assandra-driver-core-3.12.1-shaded.jar|https://repo1.maven.org/maven2/org/apache/cassandra/cassandra-driver-core/3.12.1/cassandra-driver-core-3.12.1-shaded.jar]
> # surviving descriptor shows the bundled version
> unzip -p cassandra-driver-core-3.12.1-shaded.jar
> META-INF/maven/io.netty/netty-resolver/pom.properties
> # -> version=4.1.94.Final
> # netty-handler has no descriptor, but its classes are there
> unzip -l cassandra-driver-core-3.12.1-shaded.jar
> 'META-INF/maven/io.netty/netty-handler/pom.*'
> unzip -l cassandra-driver-core-3.12.1-shaded.jar
> 'com/datastax/shaded/netty/handler/ssl/SslClientHelloHandler.class'
> Related: CASSANDRA-19654 (update the bundled driver dependency, open since
> 2024-05-22) and CASSANDRA-20329 (move the driver to a tools-only dependency).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
