TEZ-4422 : [CVE-2021-43138] Upgrade async from 2.3.0 to 2.6.4 by amanraj2520 · Pull Request #217 · apache/tez

amanraj2520 · 2022-06-07T07:15:01Z

Upgrade async from 2.3.0 to 2.6.4 to fix the vulnerability. Also an upgrade of yarn version to 1.6.0 and frontend maven plugin to 1.8.0 was done along with this change. Link to JIRA : https://issues.apache.org/jira/browse/TEZ-4422

Link to parent JIRA : https://issues.apache.org/jira/browse/TEZ-4419

RFC documentation : https://github.com/yarnpkg/rfcs/blob/master/implemented/0000-selective-versions-resolutions.md

…the vulnerability. Also an upgrade of yarn version to 1.6.0 and frontend maven plugin to 1.8.0 was done.

amanraj2520 · 2022-06-07T07:16:45Z

@abstractdog Can you please review this PR. As suggested by you, I am raising individual PR's for the TEZ-4419 parent issue.

tez-yetus · 2022-06-07T09:32:54Z

💔 -1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	13m 49s	Docker mode activated.
		_ Prechecks _
+1 💚	dupname	0m 0s	No case conflicting files found.
+1 💚	@author	0m 0s	The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s	The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
		_ master Compile Tests _
+0 🆗	mvndep	6m 49s	Maven dependency ordering for branch
+1 💚	mvninstall	11m 8s	master passed
+1 💚	compile	3m 44s	master passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚	compile	3m 21s	master passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚	javadoc	2m 52s	master passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚	javadoc	2m 13s	master passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
		_ Patch Compile Tests _
+0 🆗	mvndep	0m 17s	Maven dependency ordering for patch
+1 💚	mvninstall	6m 33s	the patch passed
+1 💚	compile	3m 34s	the patch passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚	javac	3m 34s	the patch passed
+1 💚	compile	3m 19s	the patch passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚	javac	3m 19s	the patch passed
+1 💚	whitespace	0m 0s	The patch has no whitespace issues.
+1 💚	xml	0m 3s	The patch has no ill-formed XML file.
+1 💚	javadoc	2m 38s	the patch passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚	javadoc	2m 11s	the patch passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
		_ Other Tests _
+1 💚	unit	2m 17s	tez-ui in the patch passed.
+1 💚	unit	70m 6s	root in the patch passed.
+1 💚	asflicense	1m 9s	The patch does not generate ASF License warnings.
		137m 18s

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-217/1/artifact/out/Dockerfile
GITHUB PR	#217
Optional Tests	dupname asflicense javac javadoc unit xml compile
uname	Linux 95e936e1f84c 4.15.0-169-generic #177-Ubuntu SMP Thu Feb 3 10:50:38 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	personality/tez.sh
git revision	master / `e5a5578`
Default Java	Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
Test Results	https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-217/1/testReport/
Max. process+thread count	1484 (vs. ulimit of 5500)
modules	C: tez-ui . U: .
Console output	https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-217/1/console
versions	git=2.25.1 maven=3.6.3
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

abstractdog · 2022-06-08T07:07:27Z

 <protoc.path>${env.PROTOC_PATH}</protoc.path>
 <scm.url>scm:git:https://gitbox.apache.org/repos/asf/tez.git</scm.url>
- <frontend-maven-plugin.version>1.4</frontend-maven-plugin.version>
+ <frontend-maven-plugin.version>1.8.0</frontend-maven-plugin.version>


is this related to async upgrade?

please confirm this one

@abstractdog I confirm this change

abstractdog · 2022-06-08T07:07:32Z

 <configuration>
 <nodeVersion>${nodeVersion}</nodeVersion>
- <yarnVersion>v0.21.3</yarnVersion>
+ <yarnVersion>v1.6.0</yarnVersion>


is this related to async upgrade?

please confirm this one

@abstractdog I confirm this change

I mean, this looks like a major version change of yarn, can you please let me know how is this related to the CVE patch (or is it necessary)?
I prefer doing version changes in separate patches if they're not closely related

@abstractdog The yarnVersion was changed since the selective dependency feature is only supported in yarn 1.0 and above. And yarnVersion of 1.6.0 is compatible with frontend maven plugin 1.8.0. That's why I did this change.

cool, thanks for clarifying @amanraj2520 !

abstractdog · 2022-06-08T07:07:43Z

-lodash@^4.14.0:
- version "4.17.4"
- resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.4.tgz#78203a4d1c328ae1d86dca6460e369b57f4055ae"
+lodash@^4.17.14:


is this related to async upgrade?

@abstractdog Yes these are related to async upgrade. The yark.lock file is automatically updated based on package.json.

abstractdog · 2022-06-08T07:09:11Z

left minor comments
I'm fine with upgrading single dependencies separately until Ember3 upgrade is not finished (it looks like a huge PR) if they don't clash with each other

amanraj2520 · 2022-06-08T07:11:56Z

@abstractdog @guptanikhil007 Should we first merge the Ember3 upgrade or push these vulnerability fixes first?

abstractdog · 2022-06-13T06:26:02Z

I don't think it's a problem to merge these version bumps first, and then do Ember3 update later when @jteagles has the bandwidth for it, please let me know @jteagles if have any objections with this

amanraj2520 · 2022-06-13T06:45:35Z

Yes I think we are good with these changes from our side. I have run tests locally as well with this PR. According to me we can go ahead with this merge @abstractdog

abstractdog

+1 LGTM

I'm merging in 12 hours if there are no further comments

amanraj2520 · 2022-06-14T08:25:55Z

@abstractdog Can we please merge this PR. I will raise PR's for remaining vulnerabilities as well after this.

amanraj2520 · 2022-06-15T09:13:20Z

@abstractdog Just a gentle reminder, can you please merge this PR

abstractdog · 2022-06-15T09:25:51Z

merged, sorry for the delay!

[TEZ-4422] [CVE-2021-43138] Upgrade async from 2.3.0 to 2.6.4 to fix …
a5e60b5
…the vulnerability. Also an upgrade of yarn version to 1.6.0 and frontend maven plugin to 1.8.0 was done.

guptanikhil007 approved these changes Jun 7, 2022
View reviewed changes

abstractdog reviewed Jun 8, 2022
View reviewed changes

abstractdog self-requested a review June 13, 2022 09:37

abstractdog approved these changes Jun 13, 2022
View reviewed changes

abstractdog merged commit 3da8438 into apache:masterJun 15, 2022

tez-yetus mentioned this pull request Mar 14, 2023
TEZ-4463: Upgrade jquery-ui to 1.13.2 due to CVE issues #259
Closed

tez-yetus mentioned this pull request Apr 10, 2023
TEZ-4487: Add class name profiling option in ProfileServlet #281
Merged

This was referenced Apr 27, 2023
TEZ-4492 : Approach 2 : Disable strict-ssl for Bower and Yarn Registry to avoid Registry CERT_EXPIRE issue #283
Closed
TEZ-4492 : Approach 1 : Update Bower Registry to a different mirror #284
Merged

tez-yetus mentioned this pull request May 3, 2023
TEZ-4493: Upgrade Hadoop to 3.3.6 #285
Merged

This was referenced Jun 12, 2023
TEZ-4496: Tez precommit fails while building yetus image - no alternatives for some executables #289
Merged
TEZ-4495: mvnsite fails for some modules - No public or protected classes found to document #288
Merged
Bump guava from 31.1-jre to 32.0.0-jre #290
Closed

This was referenced Jun 21, 2023
TEZ-4250: Optimise TaskImpl::getCounters. #295
Merged
TEZ-4407: Misleading split info in TezSplitGrouper logs when adjusting small splits #202
Merged

Uh oh!

Conversation

amanraj2520 commented Jun 7, 2022• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

amanraj2520 commented Jun 7, 2022

Uh oh!

tez-yetus commented Jun 7, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

abstractdog commented Jun 8, 2022

Uh oh!

amanraj2520 commented Jun 8, 2022

Uh oh!

abstractdog commented Jun 13, 2022

Uh oh!

amanraj2520 commented Jun 13, 2022

Uh oh!

abstractdog left a comment

Choose a reason for hiding this comment

Uh oh!

amanraj2520 commented Jun 14, 2022

Uh oh!

amanraj2520 commented Jun 15, 2022

Uh oh!

abstractdog commented Jun 15, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

amanraj2520 commented Jun 7, 2022•
edited
Loading