Jialiang Cai created AMBARI-26653:
-------------------------------------
Summary: Fix vulnerable Java dependencies and remove unused
Jettison
Key: AMBARI-26653
URL: https://issues.apache.org/jira/browse/AMBARI-26653
Project: Ambari
Issue Type: Bug
Reporter: Jialiang Cai
h2. Problem
Trunk commit 474f6711c18663c29c0fc674053d21e7adcc2295 still contains vulnerable
Java dependency versions targeted by open Dependabot PRs. This new issue tracks
one bounded remediation PR with five independently reviewable commits.
h2. Changes
# Upgrade centrally managed Commons BeanUtils 1.9.4 to 1.11.0 for
CVE-2025-48734, verifying enum declaringClass suppression and normal property
copying (PR #4021).
# Remove unused Jettison 1.1 dependency management and the direct server
dependency, preserving protective exclusions and removing obsolete test
exception declarations (PR #3667). Runtime dependency checks must confirm its
absence.
# Centrally align server and agent Commons Compress at 1.28.0. The server's
1.21 remains affected by CVE-2024-25710 and CVE-2024-26308, while the agent
already contains the earlier 1.26.0 fix from PR #4001. Remove the agent's old
Commons IO override so both modules resolve compatible IO 2.21.0.
# Upgrade agent Commons Configuration2 2.10.1 to 2.15.0 and Commons Logging
1.1.3 to 1.3.6 for compatible runtime dependencies (PR #4136 / CVE-2026-45205).
Preserve Hadoop utility behavior without introducing optional SnakeYAML.
# Align the Jackson BOM and databind properties at 2.18.9, including core and
related modules, to address PRs #4152 and #4153. Verify asynchronous parser
number limits and case-insensitive ignored-property handling.
h2. Validation
JDK 17 and Maven 3.9.11. The combined focused server and agent lifecycle passed
66 tests with zero failures or skips within the selected Java tests. Python
tests were explicitly skipped. Tests cover JSON parsing/serialization,
bootstrap, execution commands, configuration archives, management packs,
credential-store handling, and ZooKeeper migration. BeanUtils and Jackson
security regressions fail with the vulnerable versions and pass with the
patched versions. Final server, agent, and utility runtime dependency trees
were checked.
The initial server lifecycle including Python tests failed because a Linux
cryptography native module cannot load on macOS. No full-suite or packaged
deployment validation is claimed.
h2. Scope And Constraints
Keep all five topics in one PR, with each topic and its tests in a separate
commit using this new JIRA key. Preserve JDK 17, public REST behavior, and
existing agent tools. Do not claim an exploitable Ambari endpoint based only on
dependency versions. The optional YAML path in Configuration2 is not resolved
in the agent. The server's separate transitive Configuration2 2.1.1, database
and pool upgrades, Jetty 12, coordinated Spring view migrations, and frontend
dependency batches remain separate follow-up work.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
