mirror of
https://github.com/Alfresco/SearchServices.git
synced 2026-09-16 18:12:56 +00:00
[MNT-25675]: Information regarding vulnerabilities reported for Htrace FasterXML dependencies (#2262)
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Grzegorz Oleksy <grzegorz.oleksy@hyland.com> Co-authored-by: Grzegorz Oleksy <106805864+goleksyalfresco@users.noreply.github.com>
This commit is contained in:
Vivek Kumar
committed by
GitHub
GitHub
co-authored by
copilot-swe-agent[bot]
Grzegorz Oleksy
Grzegorz Oleksy
copilot-swe-agent[bot]
Grzegorz Oleksy
Grzegorz Oleksy
parent
38105d99a8
commit
9d1cffecc0
@@ -57,7 +57,13 @@
|
||||
<dependency.alfresco.xml-factory.version>1.3</dependency.alfresco.xml-factory.version>
|
||||
<dependency.alfresco-data-model.version>18.20</dependency.alfresco-data-model.version>
|
||||
|
||||
<dependency.jackson.version>2.17.2</dependency.jackson.version>
|
||||
<!-- 2.18.6 fixes GHSA-72hv-8253-57qq (jackson-core async parser maxNumberLength bypass, MEDIUM).
|
||||
NOTE: htrace-core 3.2.0-incubating shades Jackson 2.4.0 internally; this property cannot
|
||||
override the shaded copy. The shaded JAR is physically removed in:
|
||||
- search-services/packaging/pom.xml (unpack exclude + antrun delete)
|
||||
- insight-engine/alfresco-insight-zeppelin/pom.xml (unpack exclude)
|
||||
The alfresco-insight-jdbc shaded jar uses an explicit <includes> list so htrace is not shaded in. -->
|
||||
<dependency.jackson.version>2.18.6</dependency.jackson.version>
|
||||
|
||||
<dependency.google.guava.version>33.1.0-jre</dependency.google.guava.version>
|
||||
<dependency.apache-commons-compress.version>1.26.1</dependency.apache-commons-compress.version>
|
||||
|
||||
@@ -74,6 +74,11 @@
|
||||
<groupId>org.apache.hadoop</groupId>
|
||||
<artifactId>*</artifactId>
|
||||
</exclusion>
|
||||
<exclusion>
|
||||
<!-- htrace deprecated; ships shaded Jackson 2.4.0; not used by Alfresco -->
|
||||
<groupId>org.apache.htrace</groupId>
|
||||
<artifactId>htrace-core</artifactId>
|
||||
</exclusion>
|
||||
<exclusion>
|
||||
<groupId>jdk.tools</groupId>
|
||||
<artifactId>jdk.tools</artifactId>
|
||||
@@ -134,6 +139,11 @@
|
||||
<groupId>org.apache.hadoop</groupId>
|
||||
<artifactId>*</artifactId>
|
||||
</exclusion>
|
||||
<exclusion>
|
||||
<!-- htrace deprecated; ships shaded Jackson 2.4.0; not used by Alfresco -->
|
||||
<groupId>org.apache.htrace</groupId>
|
||||
<artifactId>htrace-core</artifactId>
|
||||
</exclusion>
|
||||
<exclusion>
|
||||
<groupId>commons-configuration</groupId>
|
||||
<artifactId>commons-configuration</artifactId>
|
||||
@@ -198,6 +208,11 @@
|
||||
<groupId>org.apache.hadoop</groupId>
|
||||
<artifactId>*</artifactId>
|
||||
</exclusion>
|
||||
<exclusion>
|
||||
<!-- htrace deprecated; ships shaded Jackson 2.4.0; not used by Alfresco -->
|
||||
<groupId>org.apache.htrace</groupId>
|
||||
<artifactId>htrace-core</artifactId>
|
||||
</exclusion>
|
||||
<exclusion>
|
||||
<groupId>log4j</groupId>
|
||||
<artifactId>log4j</artifactId>
|
||||
@@ -258,6 +273,11 @@
|
||||
<groupId>org.apache.hadoop</groupId>
|
||||
<artifactId>*</artifactId>
|
||||
</exclusion>
|
||||
<exclusion>
|
||||
<!-- htrace deprecated; ships shaded Jackson 2.4.0; not used by Alfresco -->
|
||||
<groupId>org.apache.htrace</groupId>
|
||||
<artifactId>htrace-core</artifactId>
|
||||
</exclusion>
|
||||
<exclusion>
|
||||
<groupId>org.simpleframework</groupId>
|
||||
<artifactId>simple-xml</artifactId>
|
||||
@@ -426,6 +446,11 @@
|
||||
<groupId>org.apache.hadoop</groupId>
|
||||
<artifactId>*</artifactId>
|
||||
</exclusion>
|
||||
<exclusion>
|
||||
<!-- htrace deprecated; ships shaded Jackson 2.4.0; not used by Alfresco -->
|
||||
<groupId>org.apache.htrace</groupId>
|
||||
<artifactId>htrace-core</artifactId>
|
||||
</exclusion>
|
||||
<exclusion>
|
||||
<groupId>log4j</groupId>
|
||||
<artifactId>log4j</artifactId>
|
||||
|
||||
@@ -111,7 +111,8 @@
|
||||
<outputDirectory>${project.build.directory}/solr-libs</outputDirectory>
|
||||
<excludes>**/jackson-dataformat-smile-*.jar,**/asm-3.3.1.jar,**/jackson-core-asl-*.jar,**/jackson-mapper-asl-*.jar,**/dom4j-1.6.1.jar,
|
||||
**/annotations-1.0.0.jar,**/spring-context-support-*.jar,**/spring-web-*.jar,**/woodstox-core-asl-4.4.1.jar, **/isoparser-1.1.18.jar,
|
||||
**/metadata-extractor-2.9.1.jar,**/org.restlet.ext.servlet-2.3.0.jar,**/reload4j-*.jar
|
||||
**/metadata-extractor-2.9.1.jar,**/org.restlet.ext.servlet-2.3.0.jar,**/reload4j-*.jar,
|
||||
**/htrace-core-*-incubating.jar
|
||||
</excludes>
|
||||
</artifactItem>
|
||||
</artifactItems>
|
||||
@@ -180,6 +181,12 @@
|
||||
<delete file="${project.build.directory}/solr-${solr.version}/server/solr-webapp/webapp/WEB-INF/lib/hadoop-common-2.10.1.jar" />
|
||||
<delete file="${project.build.directory}/solr-${solr.version}/server/solr-webapp/webapp/WEB-INF/lib/hadoop-hdfs-2.10.1.jar" />
|
||||
<delete file="${project.build.directory}/solr-${solr.version}/server/solr-webapp/webapp/WEB-INF/lib/hadoop-hdfs-client-2.10.1.jar" />
|
||||
<!-- Remove retired Apache HTrace incubator JAR. It ships shaded copies of jackson-core/databind 2.4.0 with
|
||||
~50 CVEs (CVSS up to 9.8) and cannot be patched via dependencyManagement. Its only consumers in this
|
||||
distribution were the hadoop-*-2.10.1.jar files removed above, so it is safe to delete. -->
|
||||
<delete>
|
||||
<fileset dir="${project.build.directory}/solr-${solr.version}" includes="**/htrace-core-*-incubating.jar" />
|
||||
</delete>
|
||||
<delete file="${project.build.directory}/solr-${solr.version}/server/solr-webapp/webapp/WEB-INF/lib/avatica-core-1.9.0.jar" />
|
||||
<delete file="${project.build.directory}/solr-${solr.version}/server/solr-webapp/webapp/WEB-INF/lib/org.restlet-2.3.0.jar" />
|
||||
<delete file="${project.build.directory}/solr-${solr.version}/server/solr-webapp/webapp/WEB-INF/lib/org.restlet.ext.servlet-2.3.0.jar" />
|
||||
|
||||
@@ -60,9 +60,9 @@ chemistry-opencmis-server-bindings-1.0.0.jar http://chemistry.apache.org/
|
||||
failureaccess-1.0.2.jar https://mvnrepository.com/artifact/com.google.guava/failureaccess/1.0.2
|
||||
listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar https://mvnrepository.com/artifact/com.google.guava/listenablefuture
|
||||
quartz-2.3.2.jar http://quartz-scheduler.org/
|
||||
jackson-core-2.17.2.jar https://github.com/FasterXML/jackson
|
||||
jackson-annotations-2.17.2.jar https://github.com/FasterXML/jackson
|
||||
jackson-databind-2.17.2.jar https://github.com/FasterXML/jackson
|
||||
jackson-core-2.18.6.jar https://github.com/FasterXML/jackson
|
||||
jackson-annotations-2.18.6.jar https://github.com/FasterXML/jackson
|
||||
jackson-databind-2.18.6.jar https://github.com/FasterXML/jackson
|
||||
commons-httpclient-3.1-HTTPCLIENT-1265.jar http://jakarta.apache.org/commons/
|
||||
spring-beans-7.0.7.jar http://projects.spring.io/spring-framework/
|
||||
spring-context-7.0.7.jar http://projects.spring.io/spring-framework/
|
||||
@@ -167,7 +167,6 @@ eigenbase-properties-1.1.5.jar
|
||||
gmetric4j-1.0.7.jar
|
||||
guava-33.1.0-jre.jar
|
||||
hppc-0.7.1.jar
|
||||
htrace-core-3.2.0-incubating.jar
|
||||
httpclient-4.5.14.jar
|
||||
httpcore-4.4.1.jar
|
||||
httpmime-4.4.1.jar
|
||||
|
||||
Reference in New Issue
Block a user