Skip to content

Conversation

@nikhilerigila09
Copy link
Contributor

@nikhilerigila09 nikhilerigila09 commented May 3, 2024

Fixes #22626

Motivation

Avoid CVE-2023-4586

Modifications

Upgrade debezium-oracle-connector version to 2.2.0.Final
which avoids org.infinispan:infinispan-client-hotrod@14.0.4.Final which has the vulnerability and uses org.infinispan:infinispan-client-hotrod-jakarta@14.0.4.Final instead, which has no vulnerabilities.

Verifying this change

  • Make sure that the change passes the CI checks.

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

  • Dependencies (add or upgrade a dependency)
  • The public API
  • The schema
  • The default values of configurations
  • The threading model
  • The binary protocol
  • The REST endpoints
  • The admin CLI options
  • The metrics
  • Anything that affects deployment

Documentation

  • doc
  • doc-required
  • doc-not-needed
  • doc-complete

@github-actions github-actions bot added the doc-not-needed Your PR changes do not impact docs label May 3, 2024
Copy link
Contributor

@nicoloboschi nicoloboschi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@lhotari lhotari merged commit 4a59536 into apache:master May 3, 2024
@lhotari
Copy link
Member

lhotari commented May 3, 2024

Just wondering that we are upgrading this connector to a newer Debezium version than the others. It seems like a hack. I wonder why we are sticking to an old Debezium version for others.

@nikhil-ctds
Copy link

@lhotari We could update the debezium version for others as well. Since only debezuim-oracle-connector had vulnerabilites (indirectly due to infinispan-client-hotrod) , i updated for oracle. I haven't checked for the other debezium connectors if there are any transitive dependencies which have vulnerabilities.

@lhotari
Copy link
Member

lhotari commented May 7, 2024

@nikhil-ctds Did you ensure that tests pass? I don't see the tests passing and this PR will need to be reverted. @nicoloboschi @shoothzj Please review the revert PR #22668

@nikhilerigila09
Copy link
Contributor Author

@lhotari
The CI check failed in CI Flaky - System - Pulsar IO - Oracle. I haven't tested it, but i see an issue open for flaky test - #13953

@lhotari
Copy link
Member

lhotari commented May 9, 2024

@lhotari The CI check failed in CI Flaky - System - Pulsar IO - Oracle. I haven't tested it, but i see an issue open for flaky test - #13953

@nikhilerigila09 In this case, it's the test that validates changes in this area. It was failing consistently. This PR has been reverted in #22668, so there's a new chance to attempt to address CVE-2023-4586 in a way that doesn't break existing functionality.

@lhotari
Copy link
Member

lhotari commented May 9, 2024

@nikhilerigila09 #22668 describes the way how to find the error logs of an integration test.

@lhotari
Copy link
Member

lhotari commented May 14, 2024

Note: This PR shouldn't be cherry-picked since it breaks the connector. Reverted in #22668.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

doc-not-needed Your PR changes do not impact docs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Infinispan Client Hotrod has a vulnerability CVE-2023-4586

6 participants