FrankChen021 commented on code in PR #20236:
URL: https://github.com/apache/druid/pull/20236#discussion_r3989429010
##########
owasp-dependency-check-suppressions.xml:
##########
@@ -768,4 +813,135 @@
<packageUrl regex="true">^pkg:maven/io\.grpc/grpc-.*@.*$</packageUrl>
<cve>CVE-2026-33186</cve> <!-- Only applicable to gRPC Go
(google.golang.org/grpc < 1.79.3), not gRPC Java -
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 -->
</suppress>
+
+
+ <suppress>
+ <!-- GHSA-w5hq-g745-h8pq: Missing bounds check in uuid v3/v5/v6 when the
optional buf
+ argument is provided. Druid's web console uses only uuidv4() with no
buf argument
+ (web-console/src/druid-models/workbench-query/workbench-query.ts), so
the
+ vulnerable code path is never exercised. -->
+ <notes><![CDATA[
+ file name: package-lock.json (pkg:npm/[email protected])
+ ]]></notes>
+ <packageUrl regex="true">^pkg:npm/uuid@.*$</packageUrl>
+ <vulnerabilityName>GHSA-w5hq-g745-h8pq</vulnerabilityName>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-53914: Unsafe deserialization in Kotlin's build cache
metadata (Kotlin compiler/Gradle plugin).
+ This is a build-toolchain vulnerability, not a runtime stdlib issue.
Druid has no Kotlin source files;
+ kotlin-stdlib is a transitive runtime dependency (via Iceberg) and
Druid never invokes Kotlin's build cache. -->
+ <notes><![CDATA[
+ file name: kotlin-stdlib-2.4.10.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin-stdlib@.*$</packageUrl>
+ <cve>CVE-2026-53914</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-33117: Vulnerability in Azure SDK for Java's Key Vault Keys
local cryptographic verification path.
+ Druid's azure-extensions use azure-core/azure-identity for blob
storage auth only; Druid does not use
+ azure-keyvault-keys or the local cryptography client path that
contains the vulnerability. -->
+ <notes><![CDATA[
+ file name: azure-core-1.58.1.jar azure-core-http-netty-1.16.5.jar
azure-identity-1.18.4.jar azure-json-1.5.1.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/com\.azure/azure-.*@.*$</packageUrl>
+ <cve>CVE-2026-33117</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-49845: SQL injection in Hive Metastore partition-name
resolution.
+ CVE-2026-53561: SAML bearer-token authentication bypass in
HiveServer2.
+ CVE-2026-55976: SSRF via avro.schema.url in Avro SerDe schema
resolution.
+ All three affect Apache Hive server components (Metastore,
HiveServer2).
+ Druid uses hive-storage-api only for the Murmur3 hash utility
+ (BloomKFilter.java) and ORC/Parquet column type definitions — it does
not
+ run or connect to a Hive Metastore or HiveServer2. -->
+ <notes><![CDATA[
+ file name: hive-storage-api-4.2.0.jar
+ ]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.hive/hive-storage-api@.*$</packageUrl>
+ <cve>CVE-2026-49845</cve>
+ <cve>CVE-2026-53561</cve>
+ <cve>CVE-2026-55976</cve>
+ </suppress>
+
+ <suppress>
+ <!-- CVE-2026-54512, CVE-2026-54513: PolymorphicTypeValidator bypass in
jackson-databind when
+ polymorphic typing is enabled with generic type parameters or array
subtypes.
+ These CVEs affect jackson-databind shaded inside
hadoop-client-runtime-3.5.0.jar and
+ parquet-jackson-1.18.0.jar — not Druid's own jackson-databind
(2.22.x). Druid cannot
+ upgrade the jackson version inside these third-party shaded jars.
Druid's own usage of
+ @JsonTypeInfo uses a custom StrictTypeIdResolver that is not affected
by these bypass paths.
+ CVE-2026-68497: Not yet published in NVD; suppressed as appearing
only inside shaded
+ hadoop/parquet jars that Druid cannot control. -->
+ <notes><![CDATA[
+ file name: hadoop-client-runtime-3.5.0.jar (shaded jackson-databind
2.18.6)
+ parquet-jackson-1.18.0.jar (shaded jackson-databind 2.22.1)
+ ]]></notes>
+ <filePath
regex="true">.*/(hadoop-client-runtime|parquet-jackson)-[0-9][^/]*\.jar[!/]+jackson-databind-[0-9].*\.jar$</filePath>
Review Comment:
[P1] Scope the shaded-JAR suppressions to actual paths
This filePath pattern requires a dependency path shaped like
hadoop-client-runtime-3.5.0.jar/.../jackson-databind-<version>.jar. The
artifacts named in the comment do not have that layout:
hadoop-client-runtime-3.5.0.jar is a flat shaded JAR with relocated
Jackson/Jetty/JLine classes and no nested JAR entries, while
parquet-jackson-1.18.0.jar declares jackson-databind as a separate dependency
rather than embedding it. Dependency-Check matches filePath against the
dependency's actual file path, so the Hadoop finding has the outer
hadoop-client-runtime path and the Parquet finding has a standalone Jackson
path; neither matches this expression. The analogous Jetty and JLine
expressions at lines 898 and 910 fail for the same reason. As a result, these
CVEs remain unsuppressed and the release-profile dependency-check can still
fail, or the rule is not scoped to the intended shaded code. Please scope each
suppression using the actual scanner paths/component relationships and verify
the
result against a generated report.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
