Fix Fix CVE-2023-6378

exasol · Dec 4, 2023 · d107204 · d107204
1 parent dd3f4ef
commit d107204
Show file tree

Hide file tree

Showing 3 changed files with 97 additions and 63 deletions.
diff --git a/dependencies.md b/dependencies.md
diff --git a/doc/changes/changes_2.7.9.md b/doc/changes/changes_2.7.9.md
@@ -1,9 +1,13 @@
 # Cloud Storage Extension 2.7.9, released 2023-??-??
 
-Code name:
+Code name: Fix CVE-2023-6378
 
 ## Summary
 
+This release fixes vulnerability CVE-2023-6378 (CWE-502: Deserialization of Untrusted Data (7.1)) in the following dependencies:
+* `ch.qos.logback:logback-classic:jar:1.2.10:compile`
+* `ch.qos.logback:logback-core:jar:1.2.10:compile`
+
 ## Features
 
 * ISSUE_NUMBER: description
@@ -26,6 +30,11 @@ Code name:
 * Updated `org.apache.orc:orc-core:1.9.1` to `1.9.2`
 * Updated `org.jetbrains.kotlin:kotlin-stdlib:1.9.20` to `1.9.21`
 
+#### Runtime Dependency Updates
+
+* Added `ch.qos.logback:logback-classic:1.2.13`
+* Added `ch.qos.logback:logback-core:1.2.13`
+
 #### Test Dependency Updates
 
 * Updated `com.exasol:exasol-testcontainers:6.6.3` to `7.0.0`

diff --git a/pom.xml b/pom.xml
@@ -191,11 +191,25 @@
             <version>${hadoop.version}</version>
         </dependency>
         <dependency>
-            <!-- override version 3.6.3 to fix vulnerability CVE-2023-42503 -->
+            <!-- Upgrade transitive dependency of org.apache.hadoop:hadoop-common from default version 3.6.3 to fix CVE-2023-42503 -->
             <groupId>org.apache.zookeeper</groupId>
             <artifactId>zookeeper</artifactId>
             <version>3.9.1</version>
         </dependency>
+        <dependency>
+            <!-- Upgrade transitive dependency of org.apache.zookeeper:zookeeper to fix CVE-2023-6378 -->
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-classic</artifactId>
+            <version>1.2.13</version>
+            <scope>runtime</scope>
+        </dependency>
+        <dependency>
+            <!-- Upgrade transitive dependency of org.apache.zookeeper:zookeeper to fix CVE-2023-6378 -->
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-core</artifactId>
+            <version>1.2.13</version>
+            <scope>runtime</scope>
+        </dependency>
         <dependency>
             <groupId>org.apache.hadoop</groupId>
             <artifactId>hadoop-azure</artifactId>