Address CVEs in transitive HBase 1x dependencies

This project depends on interfaces and value types from HBase to create a compatibility layer from the HBase api to Cloud Bigtable service. Unfortunately HBase does not provide an interface only artifact, instead it provides 2 client artifacts: hbase-client and hbase-shaded-client. hbase-shaded-client shades most of its dependencies to avoid classpath conflicts. java-bigtable-hbase has to depend on hbase-shaded-client to avoid dependency conflicts from very old versions of guava and protobuf.

One of some of the dependencies that hbase-shaded-client shades is the hadoop-common 2.8.5. This artifact has a known CVE related to its shell escaping of the tar command. Although this CVE cannot be activated by Cloud Bigtable (java-bigtable-hbase doesn't do anything with tar files), this will create alerts for endusers.

The problem is a bit difficult to solve because the HBase 1x is no longer supported by the HBase project, so apache will not release a new version. In the meantime for end users that have strict security policies we recommend to migrate to HBase 2x apis via bigable-hbase-2x (regular, shaded or hadoop). For end users of CloudBigtableIO, I would recommend to use the native (nonhbase) BigtableIO connector until we release a version compatible with HBase 2x.

Inizia esaminando le dichiarazioni delle dipendenze di hbase-shaded-client e la sua dipendenza transitiva hadoop-common 2.8.5, quindi conferma la CVE segnalata relativa all’escaping della shell di tar e la sua raggiungibilità in questa libreria. Il lavoro sarà completato quando sarà disponibile una correzione supportata che rimuova l’avviso per l’utente finale senza compromettere il layer di compatibilità HBase 1.x; l’issue non indica file né test.