Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump dnsjava version to 3.6.0 to address CVE-2024-25638 #15173

Merged
merged 4 commits into from
Aug 13, 2024

Conversation

derek-ho
Copy link
Contributor

@derek-ho derek-ho commented Aug 8, 2024

Description

Bumps dnsjava to v3.6.0 to address GHSA-cfxw-4h78-h7fw

Related Issues

Resolves #14183

Check List

  • Functionality includes testing.
  • API changes companion pull request created, if applicable.
  • Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Derek Ho <dxho@amazon.com>
Signed-off-by: Derek Ho <dxho@amazon.com>
Copy link
Contributor

github-actions bot commented Aug 8, 2024

❌ Gradle check result for 182c70b: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

Copy link
Contributor

github-actions bot commented Aug 8, 2024

❌ Gradle check result for 1ca54db: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

@reta reta added backport 2.x Backport to 2.x branch skip-changelog labels Aug 12, 2024
Co-authored-by: Andriy Redko <drreta@gmail.com>
Signed-off-by: Derek Ho <derek01778@gmail.com>
@derek-ho derek-ho changed the title Bump dnsjava version Bump dnsjava version to 3.6.0 to address CVE-2024-25638 Aug 13, 2024
@derek-ho derek-ho marked this pull request as ready for review August 13, 2024 14:13
@github-actions github-actions bot added CVE Fixes a CVE Mend: dependency security vulnerability Security vulnerability detected by WhiteSource Storage Issues and PRs relating to data and metadata storage labels Aug 13, 2024
Copy link
Contributor

❌ Gradle check result for 1f69c8b: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

@reta
Copy link
Collaborator

reta commented Aug 13, 2024

@derek-ho could you rebase against latest main please? thank you

Copy link
Contributor

❕ Gradle check result for 576655e: UNSTABLE

Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure.

Copy link

codecov bot commented Aug 13, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 71.90%. Comparing base (b6c80b1) to head (576655e).
Report is 2 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff            @@
##               main   #15173   +/-   ##
=========================================
  Coverage     71.90%   71.90%           
  Complexity    63033    63033           
=========================================
  Files          5197     5197           
  Lines        295313   295313           
  Branches      42677    42677           
=========================================
+ Hits         212354   212358    +4     
+ Misses        65552    65525   -27     
- Partials      17407    17430   +23     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@reta reta merged commit 54c13a6 into opensearch-project:main Aug 13, 2024
33 of 34 checks passed
opensearch-trigger-bot bot pushed a commit that referenced this pull request Aug 13, 2024
* Bump dnsjava version

Signed-off-by: Derek Ho <dxho@amazon.com>

* Change to implementation

Signed-off-by: Derek Ho <dxho@amazon.com>

* Update test/fixtures/hdfs-fixture/build.gradle

Co-authored-by: Andriy Redko <drreta@gmail.com>
Signed-off-by: Derek Ho <derek01778@gmail.com>

---------

Signed-off-by: Derek Ho <dxho@amazon.com>
Signed-off-by: Derek Ho <derek01778@gmail.com>
Co-authored-by: Andriy Redko <drreta@gmail.com>
(cherry picked from commit 54c13a6)
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
reta added a commit that referenced this pull request Aug 13, 2024
)

* Bump dnsjava version



* Change to implementation



* Update test/fixtures/hdfs-fixture/build.gradle




---------




(cherry picked from commit 54c13a6)

Signed-off-by: Derek Ho <dxho@amazon.com>
Signed-off-by: Derek Ho <derek01778@gmail.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Andriy Redko <drreta@gmail.com>
wdongyu pushed a commit to wdongyu/OpenSearch that referenced this pull request Aug 22, 2024
…roject#15173)

* Bump dnsjava version

Signed-off-by: Derek Ho <dxho@amazon.com>

* Change to implementation

Signed-off-by: Derek Ho <dxho@amazon.com>

* Update test/fixtures/hdfs-fixture/build.gradle

Co-authored-by: Andriy Redko <drreta@gmail.com>
Signed-off-by: Derek Ho <derek01778@gmail.com>

---------

Signed-off-by: Derek Ho <dxho@amazon.com>
Signed-off-by: Derek Ho <derek01778@gmail.com>
Co-authored-by: Andriy Redko <drreta@gmail.com>
akolarkunnu pushed a commit to akolarkunnu/OpenSearch that referenced this pull request Sep 10, 2024
…roject#15173)

* Bump dnsjava version

Signed-off-by: Derek Ho <dxho@amazon.com>

* Change to implementation

Signed-off-by: Derek Ho <dxho@amazon.com>

* Update test/fixtures/hdfs-fixture/build.gradle

Co-authored-by: Andriy Redko <drreta@gmail.com>
Signed-off-by: Derek Ho <derek01778@gmail.com>

---------

Signed-off-by: Derek Ho <dxho@amazon.com>
Signed-off-by: Derek Ho <derek01778@gmail.com>
Co-authored-by: Andriy Redko <drreta@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport 2.x Backport to 2.x branch CVE Fixes a CVE Mend: dependency security vulnerability Security vulnerability detected by WhiteSource skip-changelog Storage Issues and PRs relating to data and metadata storage
Projects
Status: ✅ Done
Development

Successfully merging this pull request may close these issues.

hdfs-fixture-3.0.0-SNAPSHOT: 1 vulnerabilities (highest severity is: 8.9)
2 participants