Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security Fix: Okio CVE-2023-3635 + OkHttp Jar Update #24473

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Security Fix: Okio CVE-2023-3635 + OkHttp Jar Update #24473

wants to merge 1 commit into from

Conversation

Mariamalmesfer
Copy link
Contributor

@Mariamalmesfer Mariamalmesfer commented Feb 3, 2025 •
edited
Loading

Description

This PR fixes the Okio security vulnerability (CVE-2023-3635) by upgrading from version 1.17.2 to 3.6.0. It also includes an update to the OkHttp jar from 3.9.0 to 4.12.0

Motivation and Context

A flaw was found in Okio’s GzipSource class that doesn’t handle exceptions properly, allowing potential Denial of Service (DoS) attacks with malformed files.

CVE-2023-3635: Details

Impact

Image Scan showed the vulnerability have been removed.
correlation-report-ibm-lh-presto-okie check.csv

Test Plan

Contributor checklist

  • Please make sure your submission complies with our development, formatting, commit message, and attribution guidelines.
  • PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
  • Documented new properties (with its default value), SQL syntax, functions, or other functionality.
  • If release notes are required, they follow the release notes guidelines.
  • Adequate tests were added if applicable.
  • CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

 == RELEASE NOTES == =
Security Changes
* Upgrade okio to 3.6.0 in response to `CVE-2023-3635 <https://github.com/advisories/GHSA-w33c-445m-f8w7>`. 
* Upgrade okhttp to 4.12.0 in response to `CVE-2023-3635 <https://github.com/advisories/GHSA-w33c-445m-f8w7>`.

@prestodb-ci prestodb-ci added the from:IBM PR from IBM label Feb 3, 2025
@Mariamalmesfer Mariamalmesfer force-pushed the okie-fix-test branch 3 times, most recently from bf152d0 to 3ff2d81 Compare February 3, 2025 13:07
@Mariamalmesfer Mariamalmesfer changed the title test Security Fix: Okio CVE-2023-3635 + OkHttp Jar Update Feb 3, 2025
@Mariamalmesfer Mariamalmesfer marked this pull request as ready for review February 3, 2025 15:20
@Mariamalmesfer Mariamalmesfer requested a review from a team as a code owner February 3, 2025 15:20
@steveburnett
Copy link
Contributor

Thanks for the release note!

New release note guidelines: as of last week PR #24354 automatically adds links to this PR to the release notes. Please remove the manual PR link in the following format from the release note entries for this PR.

:pr:`12345`

I have updated the Release Notes Guidelines to remove the examples of manually adding the PR link.

@Mariamalmesfer Mariamalmesfer mentioned this pull request Feb 3, 2025
Merged
@Mariamalmesfer Mariamalmesfer force-pushed the okie-fix-test branch 2 times, most recently from eceb4b9 to ff135ba Compare February 4, 2025 13:07
ZacBlanco
ZacBlanco requested changes Feb 4, 2025
View reviewed changes
presto-jdbc/pom.xml
<relocation>
<pattern>org.jetbrains.annotations</pattern>
<shadedPattern>${shadeBase}.org.jetbrains.annotations</shadedPattern>
</relocation>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@arhimondr Can you confirm that this is the correct shading you mentioned in this comment: https://github.com/prestodb/presto/pull/23796/files#r1935889125

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to move kotlin.. Basically try to open the generated jar in the CLI and see if there are any classes outside of the com.facebook.presto package

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@arhimondr Checked the generated jar and found classes in kotlin/, jvmMain/okio/, and commonMain/okio/ outside the com.facebook.presto package. Added relocations for these. Can you check if this is correct?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me

arhimondr
arhimondr reviewed Feb 6, 2025
View reviewed changes
presto-client/pom.xml
<configuration>
<ignoredUnusedDeclaredDependencies>
<!-- This is needed to keep Okio in the build and prevent conflicts with OkHttp and Kotlin dependencies. -->
<ignoredUnusedDeclaredDependency>com.squareup.okio:okio-jvm</ignoredUnusedDeclaredDependency>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice. This is better than a Dummy hack :-)

presto-jdbc/pom.xml
<relocation>
<pattern>org.jetbrains.annotations</pattern>
<shadedPattern>${shadeBase}.org.jetbrains.annotations</shadedPattern>
</relocation>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to move kotlin.. Basically try to open the generated jar in the CLI and see if there are any classes outside of the com.facebook.presto package

@Mariamalmesfer Mariamalmesfer force-pushed the okie-fix-test branch 3 times, most recently from c1c793c to 2a42688 Compare February 11, 2025 08:57
arhimondr
arhimondr approved these changes Feb 14, 2025
View reviewed changes
presto-jdbc/pom.xml
<relocation>
<pattern>org.jetbrains.annotations</pattern>
<shadedPattern>${shadeBase}.org.jetbrains.annotations</shadedPattern>
</relocation>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ZacBlanco ZacBlanco ZacBlanco requested changes

@arhimondr arhimondr arhimondr approved these changes

@presto-oss presto-oss Awaiting requested review from presto-oss presto-oss is a code owner automatically assigned from prestodb/committers

Requested changes must be addressed to merge this pull request.

Assignees
No one assigned
Labels
from:IBM PR from IBM
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@Mariamalmesfer @steveburnett @ZacBlanco @arhimondr @prestodb-ci