nevzheng commented on issue #13157: URL: https://github.com/apache/gravitino/issues/13157#issuecomment-5673626214
suggestion: Work through these findings from **easy to complex**. Effort is not a severity ranking—confirmed, exposed product vulnerabilities should take priority. | Item | Effort | Issue | Proposed fix / disposition | Verification | |---|---|---|---|---| | PostgreSQL JDBC | Easy triage | The released image contains older drivers; main already specifies 42.7.11. | Avoid duplicate upgrade work. Verify the rebuilt image and secondary bundled copies; the released-image finding remains open. | Enumerate JARs, run PostgreSQL/Paimon tests, rescan. | | MCP WebSocket advisory | Easy triage | The SDK matches an advisory, but Gravitino does not use the affected transport. | Record **not applicable to supported transports**, with a revisit trigger if transport wiring changes. No blanket MCP exception. | Retain [upstream applicability evidence](https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-vj7q-gjh5-988w) and transport coverage. | | Java product bases | Easy–medium | Three images retain older Java 17/Jammy packages with recorded fixes. | Refresh within Java 17/Jammy; keep any JRE/slim migration separate. | Validate candidate availability, startup, TLS and integrations; scan final images. | | MCP build cache | Easy–medium | Vulnerable package copies remain in the uv download cache as well as the installed environment. | Use build-cache mounts or no-cache installation. Preserve runtime uv/venv. **Cleanup does not fix installed dependencies.** | Check cache absence, offline/non-root startup and tool calls. | | MCP HTTP dependencies | Medium | Starlette and python-multipart have form-parsing advisories. | Check route exposure, then resolve compatible updates while preserving existing dependency constraints. | Transport, TLS, OAuth/authz tests and rescan. | | MCP runtime base | Medium | Most MCP High/Critical matches concern Debian packages. | Refresh the compatible base first; evaluate slim/runtime-only packaging separately. | Native imports, startup, authentication, tool calls and final-image scan. | | Test fixtures | Medium–complex | OAuth retains build contents; older Hive/PostgreSQL variants provide intentional compatibility coverage. | Rebuild compatible fixtures individually. Confirm OAuth build ownership; document necessary exceptions. | Auth/catalog Docker tests and rescans; preserve the version matrix. | | Chart databases | Complex | Legacy database images are deployment defaults, not merely test fixtures. | Evaluate maintained, chart-compatible replacements—not blind image substitutions. | Install/upgrade, persistence, permissions, credentials and rollback tests. | | Bundled Java libraries | Complex | Avro appears inside Hadoop/cloud bundles; a top-level dependency override may not replace it. | Trace ownership and reachability; update the compatible owning distribution. | Inspect packaged classes, run affected Iceberg/Hadoop/Hive tests, rescan. | **Start with the first four rows.** No fixes, rebuilds or remediation tests have been performed by this triage. Keep findings advisory and require evidence before marking them resolved. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
