Update Management API dependencies to address CVEs #557
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@burmanm and @adejanovski I would appreciate any comments you have on this. The basic change is to update RestEasy (and move from jaxrs to jakarta) so that the transitive dependnecies for Jackson, netty and snakeyaml are updated to newer versions that satisfy some CVEs. In doing so, the Management API server now needs to run with at least JDK11 since some of the library upgrades are not compiled to run with JDK8. This isn't an issue for Cassandra 4.0+ or DSE 6.9+, but for Cassandra 3.11 and DSE 6.8.x with advanced workloads, the images will have to be updated to also install JDK11 along side JDK8. I also have a PR to deprecate Cassandra 3.11.x support, so this is ultimately only going to affect the DSE 6.8. images |
burmanm
approved these changes
Oct 28, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #556
This PR updates some of the dependencies in the server module so that the transitive dependencies they pull in are updated to newer versions that address a few CVEs, particularly with Jackson and Snakeyaml libraries. The main libraries updated are RestEasy and switching from JAXRS to Jakarta (seen mostly here: https://github.com/k8ssandra/management-api-for-apache-cassandra/pull/557/files#diff-3bf02f558ea850ad8886b5e1e10b52166a839c0fd455459d0ca8833ff3382968R19-R26).
Unfortunately, updating these libraries results in the Server portion of Management API requiring JDK11 to run. This presents a problem for some of the Docker images built within this repo, specifically Cassandra 3.11 images and DSE 6.8 images, as they only have JDK8 installed. To address this, this PR also installs Java 11 into those images, but leaves JDK8 as the default. The entrypoint scripts have been updated to "find" a Java 11 binary for running the server module, while Cassandra/DSE will still run with the appropriate JDK (8 or 11, depending on the version).