This is an automated email from the ASF dual-hosted git repository.
CalvinKirs pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/doris.git
The following commit(s) were added to refs/heads/master by this push:
new 29994a2079f [fix](fe) Update vulnerable dependencies (#69341)
29994a2079f is described below
commit 29994a2079fc8644226f8f47980c56c309bd97cc
Author: Calvin Kirs <[email protected]>
AuthorDate: Thu Oct 22 18:14:07 2026 +0800
[fix](fe) Update vulnerable dependencies (#69341)
Port the FE dependency CVE updates from #69334 to master. Upgrade
vulnerable libraries and remove unused Avro RPC, YARN client, and Hive
UDF dependencies. The Ranger Hadoop exclusions are omitted because
master's authorization plugin needs those classes.
Validation: the FE test script built 87 modules and all 7 Hive UDF tests
passed. The local Doris review found no issues.
---
fe/fe-core/pom.xml | 3 +-
.../trees/expressions/literal/JsonLiteralTest.java | 6 +-
fe/hive-udf/pom.xml | 66 ++++++++++++++++++++++
fe/pom.xml | 65 ++++++++++++++++++---
4 files changed, 129 insertions(+), 11 deletions(-)
diff --git a/fe/fe-core/pom.xml b/fe/fe-core/pom.xml
index 43fc7a869d5..c19b65251e5 100644
--- a/fe/fe-core/pom.xml
+++ b/fe/fe-core/pom.xml
@@ -929,7 +929,8 @@ under the License.
<dependency>
<groupId>com.taobao.arthas</groupId>
<artifactId>arthas-packaging</artifactId>
- <version>4.0.5</version>
+ <!-- Arthas embeds its own Netty; the FE BOM cannot update that
copy. -->
+ <version>4.3.5</version>
</dependency>
<dependency>
<groupId>org.mockito</groupId>
diff --git
a/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/expressions/literal/JsonLiteralTest.java
b/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/expressions/literal/JsonLiteralTest.java
index 6e16ea9805e..d74630974c7 100644
---
a/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/expressions/literal/JsonLiteralTest.java
+++
b/fe/fe-core/src/test/java/org/apache/doris/nereids/trees/expressions/literal/JsonLiteralTest.java
@@ -103,17 +103,17 @@ public class JsonLiteralTest {
@Test
public void testLoneHighSurrogateInObjectKey() {
- // lone surrogate in object field name must also be rejected
+ // Jackson may reject invalid field names before Doris validates the
parsed tree.
AnalysisException ex = Assertions.assertThrows(AnalysisException.class,
() -> new JsonLiteral("{\"\\uD800\":\"value\"}"));
- Assertions.assertTrue(ex.getMessage().contains("lone high surrogate"));
+ Assertions.assertTrue(ex.getMessage().contains("surrogate"));
}
@Test
public void testLoneLowSurrogateInObjectKey() {
AnalysisException ex = Assertions.assertThrows(AnalysisException.class,
() -> new JsonLiteral("{\"\\uDC00\":\"value\"}"));
- Assertions.assertTrue(ex.getMessage().contains("lone low surrogate"));
+ Assertions.assertTrue(ex.getMessage().contains("surrogate"));
}
@Test
diff --git a/fe/hive-udf/pom.xml b/fe/hive-udf/pom.xml
index aae09cdef92..8abd5646b46 100644
--- a/fe/hive-udf/pom.xml
+++ b/fe/hive-udf/pom.xml
@@ -52,8 +52,40 @@ under the License.
<groupId>org.apache.hive</groupId>
<artifactId>hive-exec</artifactId>
<version>${hive.version}</version>
+ <!-- The core artifact contains the UDF API without Hive's bundled
old libraries. -->
+ <classifier>core</classifier>
<scope>provided</scope>
<exclusions>
+ <!-- UDFs do not use LLAP, YARN APIs, or ZooKeeper. -->
+ <exclusion>
+ <groupId>org.apache.hive</groupId>
+ <artifactId>hive-llap-tez</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-yarn-api</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-yarn-common</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-yarn-registry</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.zookeeper</groupId>
+ <artifactId>zookeeper</artifactId>
+ </exclusion>
+ <!-- UDFs do not use YARN's server or the metastore's legacy
FB303 service. -->
+ <exclusion>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-yarn-server-resourcemanager</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.apache.thrift</groupId>
+ <artifactId>libfb303</artifactId>
+ </exclusion>
<exclusion>
<groupId>org.apache.calcite</groupId>
<artifactId>calcite-core</artifactId>
@@ -62,12 +94,46 @@ under the License.
<groupId>org.apache.calcite</groupId>
<artifactId>calcite-druid</artifactId>
</exclusion>
+ <!-- UDFs do not use Hive's JDBC driver or its bundled legacy
dependencies. -->
+ <exclusion>
+ <groupId>org.apache.calcite.avatica</groupId>
+ <artifactId>avatica</artifactId>
+ </exclusion>
<exclusion>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
</exclusions>
</dependency>
+ <dependency>
+ <groupId>org.apache.hive</groupId>
+ <artifactId>hive-serde</artifactId>
+ <version>${hive.version}</version>
+ <scope>provided</scope>
+ <exclusions>
+ <exclusion>
+ <groupId>org.apache.thrift</groupId>
+ <artifactId>libfb303</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.hive</groupId>
+ <artifactId>hive-common</artifactId>
+ <version>${hive.version}</version>
+ <scope>provided</scope>
+ <exclusions>
+ <!-- Generic UDFs need Hive types, not Hive's embedded web
server or console. -->
+ <exclusion>
+ <groupId>org.eclipse.jetty</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>jline</groupId>
+ <artifactId>jline</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>fe-common</artifactId>
diff --git a/fe/pom.xml b/fe/pom.xml
index 420abce568a..304507a5446 100644
--- a/fe/pom.xml
+++ b/fe/pom.xml
@@ -250,14 +250,15 @@ under the License.
from instantiating classes outside
org.apache.avro.SERIALIZABLE_PACKAGES (AVRO-4189), which breaks Hudi's
commit metadata readers. Every avro API iceberg 1.12.0 references
exists in 1.12.1. -->
<avro.version>1.12.1</avro.version>
- <parquet.version>1.18.0</parquet.version>
+ <!-- Disable file-controlled KMS URLs by default (CVE-2026-73334). -->
+ <parquet.version>1.18.1</parquet.version>
<spark.version>3.4.3</spark.version>
<hudi.version>1.0.2</hudi.version>
<obs.dependency.scope>compile</obs.dependency.scope>
<cos.dependency.scope>compile</cos.dependency.scope>
<qcloud-java-sdk.version>2.0.1</qcloud-java-sdk.version>
<tencentcos.version>8.2.7</tencentcos.version>
- <cos-api.version>5.6.211</cos-api.version>
+ <cos-api.version>5.6.269</cos-api.version>
<tencentcloud-sdk-java-sts.version>3.1.678</tencentcloud-sdk-java-sts.version>
<huaweicloud-sdk-iam.version>3.1.20</huaweicloud-sdk-iam.version>
<esdk-obs.version>3.21.11</esdk-obs.version>
@@ -288,9 +289,8 @@ under the License.
<commons-validator.version>1.9.0</commons-validator.version>
<gson.version>2.10.1</gson.version>
<guava.version>33.2.1-jre</guava.version>
- <!-- Jackson 2.16.0 is affected by multiple 2026 parser and
polymorphic-deserialization
- vulnerabilities, including CVE-2026-54512. Version 2.21.5
contains the complete fixes. -->
- <jackson.version>2.21.5</jackson.version>
+ <!-- Keep Jackson 2 aligned on the LTS maintenance release fixing
CVE-2026-110879. -->
+ <jackson.version>2.21.8</jackson.version>
<javassist.version>3.18.2-GA</javassist.version>
<javax.servlet-api.version>3.1.0</javax.servlet-api.version>
<!-- Spring Framework 7 and Jetty EE11 require Jakarta Servlet 6.1. -->
@@ -309,7 +309,7 @@ under the License.
<metrics-core.version>4.0.2</metrics-core.version>
<resilience4j.version>2.4.0</resilience4j.version>
<!-- Keep Netty compatible with Arrow Flight SQL 19 and other
transitive Netty users. -->
- <netty-all.version>4.2.17.Final</netty-all.version>
+ <netty-all.version>4.2.18.Final</netty-all.version>
<!-- OpenTelemetry versions before 1.62.0 allow unbounded allocation
while parsing W3C
baggage (CVE-2026-45292); align the complete OpenTelemetry graph
on the fixed BOM. -->
<opentelemetry.version>1.62.0</opentelemetry.version>
@@ -339,6 +339,7 @@ under the License.
<jetty-servlet.version>11.0.26</jetty-servlet.version>
<jetty-websocket.version>9.4.58.v20250814</jetty-websocket.version>
<okhttp.version>5.3.2</okhttp.version>
+ <okio.version>3.16.4</okio.version>
<snakeyaml.version>2.6</snakeyaml.version>
<zjsonpatch.version>0.2.3</zjsonpatch.version>
<kafka-clients.version>3.4.0</kafka-clients.version>
@@ -423,7 +424,10 @@ under the License.
<lz4-java-relocation.version>1.8.1</lz4-java-relocation.version>
<lz4-java.version>1.11.1</lz4-java.version>
<immutables.version>2.9.3</immutables.version>
- <ivy.version>2.5.2</ivy.version>
+ <!-- Fix PackagerResolver path traversal (CVE-2026-26032). -->
+ <ivy.version>2.6.0</ivy.version>
+ <ant.version>1.10.18</ant.version>
+ <groovy-all.version>2.4.21</groovy-all.version>
<icu4j.version>78.1</icu4j.version>
<ini4j.version>0.5.4</ini4j.version>
<!--todo waiting release-->
@@ -609,6 +613,14 @@ under the License.
<type>pom</type>
<scope>import</scope>
</dependency>
+ <!-- Align legacy cloud clients with the Okio version used by
OkHttp 5. -->
+ <dependency>
+ <groupId>com.squareup.okio</groupId>
+ <artifactId>okio-bom</artifactId>
+ <version>${okio.version}</version>
+ <type>pom</type>
+ <scope>import</scope>
+ </dependency>
<dependency>
<groupId>io.grpc</groupId>
<artifactId>grpc-bom</artifactId>
@@ -663,6 +675,22 @@ under the License.
<artifactId>ivy</artifactId>
<version>${ivy.version}</version>
</dependency>
+ <!-- Hive's provided dependencies also need the Ant and Groovy
security fixes. -->
+ <dependency>
+ <groupId>org.apache.ant</groupId>
+ <artifactId>ant</artifactId>
+ <version>${ant.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.ant</groupId>
+ <artifactId>ant-launcher</artifactId>
+ <version>${ant.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>org.codehaus.groovy</groupId>
+ <artifactId>groovy-all</artifactId>
+ <version>${groovy-all.version}</version>
+ </dependency>
<dependency>
<groupId>org.eclipse.jetty.websocket</groupId>
<artifactId>websocket-client</artifactId>
@@ -1681,6 +1709,13 @@ under the License.
<groupId>org.apache.avro</groupId>
<artifactId>avro-mapred</artifactId>
<version>${avro.version}</version>
+ <exclusions>
+ <!-- File readers do not start Avro's Jetty RPC server. -->
+ <exclusion>
+ <groupId>org.apache.avro</groupId>
+ <artifactId>avro-ipc-jetty</artifactId>
+ </exclusion>
+ </exclusions>
</dependency>
<!--
https://mvnrepository.com/artifact/org.apache.hudi/hudi-common -->
<dependency>
@@ -1785,6 +1820,11 @@ under the License.
<artifactId>parquet-hadoop</artifactId>
<version>${parquet.version}</version>
</dependency>
+ <dependency>
+ <groupId>org.apache.parquet</groupId>
+ <artifactId>parquet-hadoop-bundle</artifactId>
+ <version>${parquet.version}</version>
+ </dependency>
<dependency>
<groupId>org.apache.parquet</groupId>
<artifactId>parquet-common</artifactId>
@@ -1869,6 +1909,11 @@ under the License.
<artifactId>hadoop-mapreduce-client-core</artifactId>
<version>${hadoop.version}</version>
<exclusions>
+ <!-- File readers do not submit YARN jobs; this client
brings EOL Jetty 9 WebSockets. -->
+ <exclusion>
+ <groupId>org.apache.hadoop</groupId>
+ <artifactId>hadoop-yarn-client</artifactId>
+ </exclusion>
<exclusion>
<groupId>javax.servlet</groupId>
<artifactId>servlet-api</artifactId>
@@ -2130,6 +2175,12 @@ under the License.
</exclusion>
</exclusions>
</dependency>
+ <!-- hadoop-cos uses classes inside this shaded bundle; keep both
COS SDK artifacts aligned. -->
+ <dependency>
+ <groupId>com.qcloud</groupId>
+ <artifactId>cos_api-bundle</artifactId>
+ <version>${cos-api.version}</version>
+ </dependency>
<dependency>
<groupId>com.qcloud</groupId>
<artifactId>qcloud-java-sdk</artifactId>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
