[
https://issues.apache.org/jira/browse/AMBARI-26653?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jialiang Cai updated AMBARI-26653:
----------------------------------
Description:
h2. Objective
Remediate the remaining applicable dependency findings in one PR,
https://github.com/apache/ambari/pull/4208, using independently implemented,
reviewable topic commits under AMBARI-26653. Dependabot proposals are evidence
of affected dependencies, not implementation patches to copy.
h2. Initial Remediation
The first five commits upgrade Commons BeanUtils, remove unused Jettison, align
Commons Compress and Commons IO, upgrade agent Commons Configuration, and align
Jackson 2.18.9. The focused combined Java lifecycle passed 66 tests and the
first PR revision passed Jenkins.
h2. Expanded Scope
# Modern frontend: patch Nanoid, Browserslist, HumanFS, Immutable and affected
brace-expansion copies; coordinate Files View Vitest/Vite/esbuild with
compatible React tooling. Regenerate native lockfiles and validate
installation, builds and tests. Covers #4190, #4191, #4192, #4193, #4194,
#4199, #4185 and relevant #4162 copies.
# Legacy frontend: independently resolve Express, tar, js-yaml and
brace-expansion in the actual classic build. Audit obsolete duplicate root
dependency graphs and unused packages before removing or updating them. Covers
#3594, #4109, #4157, #4162.
# Python build tooling: use patched setuptools and regenerate hashed build
locks. Separate its Python 3.10+ build prerequisite from Ambari's retained
Python 3.9.2+ runtime support, including source installation and packaged
artifacts. Covers #4200.
# Database runtime and test drivers: migrate H2 to a supported patched 2.x
release with SQL/ORM compatibility, upgrade c3p0 with connection and recovery
tests, and use stable compatible MariaDB and SQL Server drivers. Covers #3717,
#4156, #4183, #4083.
# Spring example views: replace isolated legacy Spring pins with a coherent
patched Spring 6.2 family, Jakarta Servlet APIs/descriptors, and
context/dispatch/data-migration tests. Covers #3609, #3610, #4020, #4022,
#4159, #4160, #4161.
# Jetty: migrate to a patched Jetty 12.0 EE10 family with Servlet 6,
coordinating artifact names, HTTP/HTTPS handlers, view/session behavior and
WebSocket lifecycle. Covers #4155.
# Kerberos: replace mutually incompatible retired ApacheDS Kerberos
client/codec APIs with maintained Apache Kerby, align Directory LDAP API, and
preserve KDC probing, key derivation, keytab format/merge/permissions and
authentication behavior. Covers #4196, #4197.
h2. Acceptance And Review
Use one PR with coherent topic commits and focused tests in the same commit.
Remain on JDK 17 and preserve Ambari runtime behavior. Verify real resolved
dependency graphs, supported API compatibility, failure/recovery paths and
packaged outputs. Each new topic requires its own exact validation evidence,
followed by integrated validation. Record existing test failures and platform
limitations explicitly. No final success for the expanded scope is claimed
while integration is in progress.
Dependency versions alone do not prove an exploitable Ambari endpoint. Broader
unrelated audit findings remain separately documented; this change covers the
enumerated open proposals and dependencies required for their safe remediation.
was:
h2. Problem
Trunk commit 474f6711c18663c29c0fc674053d21e7adcc2295 still contains vulnerable
Java dependency versions targeted by open Dependabot PRs. This new issue tracks
one bounded remediation PR with five independently reviewable commits.
h2. Changes
# Upgrade centrally managed Commons BeanUtils 1.9.4 to 1.11.0 for
CVE-2025-48734, verifying enum declaringClass suppression and normal property
copying (PR #4021).
# Remove unused Jettison 1.1 dependency management and the direct server
dependency, preserving protective exclusions and removing obsolete test
exception declarations (PR #3667). Runtime dependency checks must confirm its
absence.
# Centrally align server and agent Commons Compress at 1.28.0. The server's
1.21 remains affected by CVE-2024-25710 and CVE-2024-26308, while the agent
already contains the earlier 1.26.0 fix from PR #4001. Remove the agent's old
Commons IO override so both modules resolve compatible IO 2.21.0.
# Upgrade agent Commons Configuration2 2.10.1 to 2.15.0 and Commons Logging
1.1.3 to 1.3.6 for compatible runtime dependencies (PR #4136 / CVE-2026-45205).
Preserve Hadoop utility behavior without introducing optional SnakeYAML.
# Align the Jackson BOM and databind properties at 2.18.9, including core and
related modules, to address PRs #4152 and #4153. Verify asynchronous parser
number limits and case-insensitive ignored-property handling.
h2. Validation
JDK 17 and Maven 3.9.11. The combined focused server and agent lifecycle passed
66 tests with zero failures or skips within the selected Java tests. Python
tests were explicitly skipped. Tests cover JSON parsing/serialization,
bootstrap, execution commands, configuration archives, management packs,
credential-store handling, and ZooKeeper migration. BeanUtils and Jackson
security regressions fail with the vulnerable versions and pass with the
patched versions. Final server, agent, and utility runtime dependency trees
were checked.
The initial server lifecycle including Python tests failed because a Linux
cryptography native module cannot load on macOS. No full-suite or packaged
deployment validation is claimed.
h2. Scope And Constraints
Keep all five topics in one PR, with each topic and its tests in a separate
commit using this new JIRA key. Preserve JDK 17, public REST behavior, and
existing agent tools. Do not claim an exploitable Ambari endpoint based only on
dependency versions. The optional YAML path in Configuration2 is not resolved
in the agent. The server's separate transitive Configuration2 2.1.1, database
and pool upgrades, Jetty 12, coordinated Spring view migrations, and frontend
dependency batches remain separate follow-up work.
Summary: Remediate vulnerable runtime and build dependencies (was: Fix
vulnerable Java dependencies and remove unused Jettison)
> Remediate vulnerable runtime and build dependencies
> ---------------------------------------------------
>
> Key: AMBARI-26653
> URL: https://issues.apache.org/jira/browse/AMBARI-26653
> Project: Ambari
> Issue Type: Bug
> Reporter: Jialiang Cai
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> h2. Objective
> Remediate the remaining applicable dependency findings in one PR,
> https://github.com/apache/ambari/pull/4208, using independently implemented,
> reviewable topic commits under AMBARI-26653. Dependabot proposals are
> evidence of affected dependencies, not implementation patches to copy.
> h2. Initial Remediation
> The first five commits upgrade Commons BeanUtils, remove unused Jettison,
> align Commons Compress and Commons IO, upgrade agent Commons Configuration,
> and align Jackson 2.18.9. The focused combined Java lifecycle passed 66 tests
> and the first PR revision passed Jenkins.
> h2. Expanded Scope
> # Modern frontend: patch Nanoid, Browserslist, HumanFS, Immutable and
> affected brace-expansion copies; coordinate Files View Vitest/Vite/esbuild
> with compatible React tooling. Regenerate native lockfiles and validate
> installation, builds and tests. Covers #4190, #4191, #4192, #4193, #4194,
> #4199, #4185 and relevant #4162 copies.
> # Legacy frontend: independently resolve Express, tar, js-yaml and
> brace-expansion in the actual classic build. Audit obsolete duplicate root
> dependency graphs and unused packages before removing or updating them.
> Covers #3594, #4109, #4157, #4162.
> # Python build tooling: use patched setuptools and regenerate hashed build
> locks. Separate its Python 3.10+ build prerequisite from Ambari's retained
> Python 3.9.2+ runtime support, including source installation and packaged
> artifacts. Covers #4200.
> # Database runtime and test drivers: migrate H2 to a supported patched 2.x
> release with SQL/ORM compatibility, upgrade c3p0 with connection and recovery
> tests, and use stable compatible MariaDB and SQL Server drivers. Covers
> #3717, #4156, #4183, #4083.
> # Spring example views: replace isolated legacy Spring pins with a coherent
> patched Spring 6.2 family, Jakarta Servlet APIs/descriptors, and
> context/dispatch/data-migration tests. Covers #3609, #3610, #4020, #4022,
> #4159, #4160, #4161.
> # Jetty: migrate to a patched Jetty 12.0 EE10 family with Servlet 6,
> coordinating artifact names, HTTP/HTTPS handlers, view/session behavior and
> WebSocket lifecycle. Covers #4155.
> # Kerberos: replace mutually incompatible retired ApacheDS Kerberos
> client/codec APIs with maintained Apache Kerby, align Directory LDAP API, and
> preserve KDC probing, key derivation, keytab format/merge/permissions and
> authentication behavior. Covers #4196, #4197.
> h2. Acceptance And Review
> Use one PR with coherent topic commits and focused tests in the same commit.
> Remain on JDK 17 and preserve Ambari runtime behavior. Verify real resolved
> dependency graphs, supported API compatibility, failure/recovery paths and
> packaged outputs. Each new topic requires its own exact validation evidence,
> followed by integrated validation. Record existing test failures and platform
> limitations explicitly. No final success for the expanded scope is claimed
> while integration is in progress.
> Dependency versions alone do not prove an exploitable Ambari endpoint.
> Broader unrelated audit findings remain separately documented; this change
> covers the enumerated open proposals and dependencies required for their safe
> remediation.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
