kfaraz commented on code in PR #20236:
URL: https://github.com/apache/druid/pull/20236#discussion_r3931415099
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -274,6 +320,69 @@
<cve>CVE-2025-58057</cve> <!-- Netty 3.x not affected; compression issue
only in 4.x -->
<cve>CVE-2026-33870</cve> <!-- We don't use HttpPostRequestDecoder -->
<cve>CVE-2026-33871</cve> <!-- Netty 3.x not affected; HTTP/2 issues only
in 4.x -->
+ <cve>CVE-2026-44893</cve> <!-- We don't use the HAProxy codec -->
+ <cve>CVE-2026-44250</cve> <!-- We don't use the Redis codec -->
+ <cve>CVE-2026-48059</cve> <!-- We don't use the HAProxy codec -->
+ <cve>CVE-2026-44890</cve> <!-- We don't use the Redis codec -->
+ <cve>CVE-2026-44891</cve> <!-- We don't use the STOMP codec -->
+ <cve>CVE-2026-50011</cve> <!-- We don't use the Redis codec -->
+ <cve>CVE-2026-59901</cve> <!-- We don't use Netty's Bzip2Decoder; Druid
uses Apache Commons Compress for bzip2 -->
+ <cve>CVE-2026-62380</cve> <!-- We don't use the SOCKS codec; Druid uses
HTTP CONNECT proxy tunneling -->
+ <cve>CVE-2026-59898</cve> <!-- Server-side WebSocket vulnerability;
Druid's HTTP server is Jetty, not Netty -->
+ <cve>CVE-2026-59899</cve> <!-- Server-side HttpContentEncoder
vulnerability; Druid uses Netty 3.x as HTTP client only -->
+ <cve>CVE-2026-42587</cve> <!-- Affects brotli/zstd/snappy decompression
added in Netty 4.x; Netty 3.x only supports gzip/deflate -->
+ <cve>CVE-2026-42586</cve> <!-- We don't use the Redis codec -->
+ <cve>CVE-2026-44248</cve> <!-- We don't use the MQTT codec -->
+ <cve>CVE-2026-44249</cve> <!-- We don't use Netty's IpSubnetFilterRule;
Druid uses Jetty for HTTP access control -->
+ <cve>CVE-2026-45416</cve> <!-- Server-side TLS SNI vulnerability; Druid
uses Netty 3.x as TLS client only, never as a server -->
+ <cve>CVE-2026-42581</cve> <!-- Server-side HTTP request smuggling; Druid's
HTTP server is Jetty, not Netty -->
+ <cve>CVE-2026-45674</cve> <!-- Affects netty-resolver-dns which Druid
doesn't use; Druid uses JDK DNS resolution -->
+ <cve>CVE-2026-48006</cve> <!-- We don't use the Redis codec -->
+ <cve>CVE-2026-42585</cve> <!-- Server-side HTTP request smuggling; Druid's
HTTP server is Jetty, not Netty -->
+ <cve>CVE-2026-42584</cve> <!-- HttpClientCodec response desynchronization
in Netty 4.x codec; Druid uses Netty 3.x's HttpClientCodec which has a
different implementation -->
+ <cve>CVE-2026-46340</cve> <!-- We don't use SCTP transport; Druid uses
TCP/NIO -->
+ <cve>CVE-2026-42583</cve> <!-- We don't use Netty's Lz4FrameDecoder; Druid
uses lz4-java directly -->
+ <cve>CVE-2026-48043</cve> <!-- We don't use netty-codec-http2 directly;
Druid's HTTP/2 is served by Jetty -->
+ <cve>CVE-2026-56822</cve> <!-- We don't use netty-handler-ssl-ocsp -->
+ <cve>CVE-2026-56821</cve> <!-- We don't use netty-handler-ssl-ocsp -->
+ <cve>CVE-2026-47691</cve> <!-- Affects netty-resolver-dns which Druid
doesn't use; Druid uses JDK DNS resolution -->
+ <cve>CVE-2026-56820</cve> <!-- We don't use netty-handler-ssl-ocsp -->
+ <cve>CVE-2026-50010</cve> <!-- Druid's Netty 3.x HTTP client does not use
SslContextBuilder; gRPC/AWS SDK paths use managed SSL contexts -->
+ <cve>CVE-2026-42578</cve> <!-- We don't use HttpProxyHandler; Druid uses a
custom HTTP CONNECT tunnel via HttpClientCodec -->
+ <cve>CVE-2026-42579</cve> <!-- We don't use netty-codec-dns; Druid uses
JDK DNS resolution -->
+ </suppress>
+
+ <suppress>
+ <notes><![CDATA[
+ file name: async-http-client-3.0.2.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.asynchttpclient/[email protected]$</packageUrl>
Review Comment:
Hmm, 3.0.13 should not even have this vulnerability. I am not sure why it
got flagged. None of the deps seem to be pulling in 3.0.2.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
