Aiven-Open / Aiven-Open/tiered-storage-for-apache-kafka
Fix io.netty security vuln from azure module
- Ngôn ngữ chính
- Java
- Star
- 239
- Fork
- 59
- Chỉ số merge pull request
- Không có pull request nào được merge trong 30 ngày
Mô tả
# What is currently missing?
We notice that the hadoop modules explicitly exclude `netty.io` modules here: https://github.com/Aiven-Open/tiered-storage-for-apache-kafka/blob/ecfa17e445e98d6f66209cb556188e195053f334/core/build.gradle#L111
However, netty is still pulled transitively via azure-core-http-netty and reactor-netty in the storage/azure module. Netty 4.1.108.Final is causing some security tickets to trigger on our kafka nodes. We need `4.1.136.Final` or higher to patch the security concern.
# How could this be improved?
In the root build.gradle, we could add a `resolutionStrategy` like so:
```
configurations.all {
resolutionStrategy.eachDependency { details ->
if (details.requested.group == 'io.netty') {
details.useVersion nettyVersion
details.because 'CVE-2026-59921, CVE-2026-41417 and others require >= 4.1.136.Final'
}
}
```
With a nettyVersion param.
I'm assuming we can't add a `exclude group: "io.netty"` statement for azure-blob package, because it is required for that package, unlike hadoop.
# Is this a feature you would work on yourself?
I could open an upstream PR for whichever approach we think is best.
* [ ] I plan to open a pull request for this feature
Hướng dẫn đóng góp
Hướng nghiên cứu
Inspect root build.gradle and compare the existing io.netty exclusions in core/build.gradle with dependencies of the storage/azure module. Verify the chosen resolution approach preserves Azure Blob's required Netty dependencies and resolves every io.netty module to 4.1.136.Final or newer; confirm the resulting dependency tree shows the patched versions.
Do mô hình lập chỉ mục viết ra từ nội dung của issue.
Đánh giá
- Công nghệ
- azure, java, kafka
- Lĩnh vực
- build-system, security
- Loại issue
- Lỗi
- Độ khó
- 2/5
- Thời gian dự kiến
- 1-3 giờ
- Mức độ hoạt động
- Sôi nổi
- Độ rõ ràng
- Khá rõ ràng
- Mức phù hợp với người mới
- 72/100