Skip to content

Commit e570124

Browse files
fix (druid): CVE-2024-36114 (#926)
* fix (druid): CVE-2024-36114 * adapt changelog * fix changelog * fix changelog * Update CHANGELOG.md Co-authored-by: Siegfried Weber <[email protected]> --------- Co-authored-by: Siegfried Weber <[email protected]>
1 parent 812fdcf commit e570124

13 files changed

+78
-373
lines changed

CHANGELOG.md

+2
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ All notable changes to this project will be documented in this file.
6666
- spark: Fix CVE-2024-36114 in Spark 3.5.1 by upgrading a dependency.
6767
Spark 3.5.2 is not affected. ([#921])
6868
- trino: Correctly report Trino version ([#881]).
69+
- druid: Fix CVE-2024-36114 in Druid `26.0.0` and `30.0.0` by upgrading a dependency ([#926]).
6970

7071
[#783]: https://github.com/stackabletech/docker-images/pull/783
7172
[#797]: https://github.com/stackabletech/docker-images/pull/797
@@ -111,6 +112,7 @@ All notable changes to this project will be documented in this file.
111112
[#919]: https://github.com/stackabletech/docker-images/pull/919
112113
[#920]: https://github.com/stackabletech/docker-images/pull/920
113114
[#921]: https://github.com/stackabletech/docker-images/pull/921
115+
[#926]: https://github.com/stackabletech/docker-images/pull/926
114116

115117
## [24.7.0] - 2024-07-24
116118

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
Fix CVE-2024-36114
2+
see https://github.com/stackabletech/vulnerabilities/issues/834
3+
4+
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and
5+
Zstandard compression algorithms to Java. All decompressor
6+
implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash
7+
the JVM for certain input, and in some cases also leak the content of
8+
other memory of the Java process (which could contain sensitive
9+
information). When decompressing certain data, the decompressors try to
10+
access memory outside the bounds of the given byte arrays or byte
11+
buffers. Because Aircompressor uses the JDK class sun.misc.Unsafe to
12+
speed up memory access, no additional bounds checks are performed and
13+
this has similar security consequences as out-of-bounds access in C or
14+
C++, namely it can lead to non-deterministic behavior or crash the JVM.
15+
Users should update to Aircompressor 0.27 or newer where these issues
16+
have been fixed. When decompressing data from untrusted users, this can
17+
be exploited for a denial-of-service attack by crashing the JVM, or to
18+
leak other sensitive information from the Java process. There are no
19+
known workarounds for this issue.
20+
21+
diff --git a/pom.xml b/pom.xml
22+
index c0f06547f8..f1c6e2f9ee 100644
23+
--- a/pom.xml
24+
+++ b/pom.xml
25+
@@ -258,6 +258,12 @@
26+
27+
<dependencyManagement>
28+
<dependencies>
29+
+ <!-- Mitigate CVE-2024-36114: See https://github.com/stackabletech/vulnerabilities/issues/834 -->
30+
+ <dependency>
31+
+ <groupId>io.airlift</groupId>
32+
+ <artifactId>aircompressor</artifactId>
33+
+ <version>0.27</version>
34+
+ </dependency>
35+
<!-- Compile Scope -->
36+
<dependency>
37+
<groupId>commons-codec</groupId>

druid/stackable/patches/26.0.0/series

+1
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,4 @@
66
05-xmllayout-dependencies.patch
77
06-dont-build-targz.patch
88
07-cyclonedx-plugin.patch
9+
08-CVE-2024-36114-bump-aircompressor-0-27.patch

druid/stackable/patches/28.0.1/01-remove-ranger-security.patch

-33
This file was deleted.

druid/stackable/patches/28.0.1/02-prometheus-emitter-from-source.patch

-65
This file was deleted.

druid/stackable/patches/28.0.1/03-stop-building-unused-extensions.patch

-52
This file was deleted.

druid/stackable/patches/28.0.1/04-update-patch-dependencies.patch

-148
This file was deleted.

druid/stackable/patches/28.0.1/05-xmllayout-dependencies.patch

-27
This file was deleted.

0 commit comments

Comments
 (0)