Skip to content

Upgrade CXF to 3.5.5 to address CVE-2022-46363#2350

Merged
DarshitChanpura merged 6 commits intoopensearch-project:mainfrom
stephen-crawford:main-cxf-update
Dec 15, 2022
Merged

Upgrade CXF to 3.5.5 to address CVE-2022-46363#2350
DarshitChanpura merged 6 commits intoopensearch-project:mainfrom
stephen-crawford:main-cxf-update

Conversation

@stephen-crawford
Copy link
Copy Markdown
Contributor

@stephen-crawford stephen-crawford commented Dec 14, 2022 •
edited
Loading

Description

[Describe what this change achieves]
Upgrade CXF to 3.5.5 to address CVE-2022-46363

Check List

  • New functionality includes testing
  • New functionality has been documented
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@stephen-crawford stephen-crawford requested a review from a team December 14, 2022 18:13
@DarshitChanpura DarshitChanpura changed the title Main cxf update Fixes CVE-2022-46363 Dec 14, 2022
DarshitChanpura
DarshitChanpura requested changes Dec 14, 2022
View reviewed changes
@stephen-crawford
Fixed versions for all
38bc2f9 
Signed-off-by: Stephen Crawford <steecraw@amazon.com>
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Dec 14, 2022 •
edited
Loading

Codecov Report

Merging #2350 (38bc2f9) into main (cc45b04) will decrease coverage by 0.08%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##               main    #2350      +/-   ##
============================================
- Coverage     61.17%   61.09%   -0.09%     
+ Complexity     3274     3272       -2     
============================================
  Files           260      260              
  Lines         18369    18369              
  Branches       3251     3251              
============================================
- Hits          11238    11223      -15     
- Misses         5544     5559      +15     
  Partials       1587     1587
Impacted Files Coverage Δ
...t/keybyoidc/AuthenticatorUnavailableException.java 0.00% <0.00%> (-20.00%) ⬇️
.../auth/http/jwt/keybyoidc/SelfRefreshingKeySet.java 59.85% <0.00%> (-8.46%) ⬇️
...ic/auth/http/jwt/AbstractHTTPJwtAuthenticator.java 55.81% <0.00%> (-3.49%) ⬇️
.../dlic/auth/ldap2/LDAPConnectionFactoryFactory.java 57.46% <0.00%> (-1.50%) ⬇️
...ecurity/configuration/ConfigurationRepository.java 74.31% <0.00%> (+2.18%) ⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

@stephen-crawford stephen-crawford changed the title Fixes CVE-2022-46363 Upgrade CXF to 3.5.5 to address CVE-2022-46363 Dec 15, 2022
@DarshitChanpura DarshitChanpura merged commit 93faf75 into opensearch-project:main Dec 15, 2022
opensearch-trigger-bot bot pushed a commit that referenced this pull request Dec 15, 2022
@stephen-crawford @github-actions
Upgrade CXF to 3.5.5 to address CVE-2022-46363 (#2350)
dd5b5e2 
Signed-off-by: Stephen Crawford <steecraw@amazon.com>
Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com>
(cherry picked from commit 93faf75)
@opensearch-trigger-bot opensearch-trigger-bot bot mentioned this pull request Dec 15, 2022
Merged
opensearch-trigger-bot bot pushed a commit that referenced this pull request Dec 15, 2022
@stephen-crawford @github-actions
Upgrade CXF to 3.5.5 to address CVE-2022-46363 (#2350)
8e248c2 
Signed-off-by: Stephen Crawford <steecraw@amazon.com>
Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com>
(cherry picked from commit 93faf75)
@opensearch-trigger-bot opensearch-trigger-bot bot mentioned this pull request Dec 15, 2022
Merged
DarshitChanpura pushed a commit that referenced this pull request Dec 16, 2022
@opensearch-trigger-bot
Upgrade CXF to 3.5.5 to address CVE-2022-46363 (#2350) (#2357)
d2be35a
DarshitChanpura pushed a commit that referenced this pull request Dec 16, 2022
@opensearch-trigger-bot @stephen-crawford
Upgrade CXF to 3.5.5 to address CVE-2022-46363 (#2350) (#2358)
f4dde57 
Signed-off-by: Stephen Crawford <steecraw@amazon.com>
Signed-off-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com>
(cherry picked from commit 93faf75)

Co-authored-by: Stephen Crawford <65832608+scrawfor99@users.noreply.github.com>
@ulir
Copy link
Copy Markdown

ulir commented Jan 4, 2023 •
edited
Loading

Hi,
quick question: this ticket has the backport 2.4 label - does this mean there's going to be a 2.4.z release containing the fix?
Couldn't sort this out reading https://opensearch.org/releases.html - from what I read there, there's not going to be any 2.4.z releases as soon as 2.5.0 is out?
Thanks for a quick clarification!
-Uli

@stephen-crawford
Copy link
Copy Markdown
Contributor Author

stephen-crawford commented Jan 4, 2023

Hi @ulir,

You are correct in your understanding of the backporting structure. In short, we backport fixes to the latest version of all supported majors versions. So since main tracks for the next major (3.0.0), we also backport to 2.4 and 1.3 for any potential patch releases (which would be semantically versioned as 2.4.x or 1.3.x). Then because we also want to include any changes in an upcoming version of the supported majors which are still under development, we want to backport to 2.x as well for a 2.5 version. Because we are never going to have a 1.4, backporting to 1.x is not strictly necessary but you may see instances where changes are also backported to this branch as well.

@peternied peternied mentioned this pull request Jan 25, 2023
Merged
3 tasks
wuychn pushed a commit to ochprince/security that referenced this pull request Mar 16, 2023
@opensearch-trigger-bot
Upgrade CXF to 3.5.5 to address CVE-2022-46363 (opensearch-project#2350…
c3b8d87 
…) (opensearch-project#2357)
@stephen-crawford stephen-crawford deleted the main-cxf-update branch March 30, 2023 16:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cwperks cwperks cwperks approved these changes

@DarshitChanpura DarshitChanpura DarshitChanpura approved these changes

Assignees

No one assigned

Labels

backport 2.4

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@stephen-crawford @codecov-commenter @ulir @cwperks @DarshitChanpura