Skip to content

TEZ-4494: Addressing CVE-2022-41881 - Netty vulnerability - #287

Merged
abstractdog merged 1 commit into
apache:masterfrom
sercanCyberVision:TEZ-4494
Jan 4, 2024
Merged

TEZ-4494: Addressing CVE-2022-41881 - Netty vulnerability#287
abstractdog merged 1 commit into
apache:masterfrom
sercanCyberVision:TEZ-4494

Conversation

@sercanCyberVision

@sercanCyberVisionsercanCyberVision commented Jun 10, 2023

Copy link
Copy Markdown
Contributor

MOTIVATION
Current netty version in the project has high score CVE - https://nvd.nist.gov/vuln/detail/CVE-2022-41881

SOLUTION
The netty version should be upgraded, at least, to version 4.1.86.Final. The latest version as of now is 4.1.94.Final. So, upgrading to the latest version.

CHECKS
Executed the unit tests.

@tez-yetus

This comment was marked as outdated.

@tez-yetus

This comment was marked as outdated.

@tez-yetus

Copy link
Copy Markdown

💔 -1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec25m 51sDocker mode activated.
_ Prechecks _
+1 💚dupname0m 0sNo case conflicting files found.
+1 💚@author0m 0sThe patch does not contain any @author tags.
-1 ❌test4tests0m 0sThe patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
_ master Compile Tests _
+1 💚mvninstall17m 22smaster passed
+1 💚compile2m 29smaster passed with JDK Ubuntu-11.0.19+7-post-Ubuntu-0ubuntu122.04.1
+1 💚compile2m 12smaster passed with JDK Private Build-1.8.0_362-8u372-gaus1-0ubuntu122.04-b09
+1 💚javadoc1m 39smaster passed with JDK Ubuntu-11.0.19+7-post-Ubuntu-0ubuntu122.04.1
+1 💚javadoc1m 8smaster passed with JDK Private Build-1.8.0_362-8u372-gaus1-0ubuntu122.04-b09
_ Patch Compile Tests _
+1 💚mvninstall4m 57sthe patch passed
+1 💚compile2m 30sthe patch passed with JDK Ubuntu-11.0.19+7-post-Ubuntu-0ubuntu122.04.1
+1 💚javac2m 30sthe patch passed
+1 💚compile2m 13sthe patch passed with JDK Private Build-1.8.0_362-8u372-gaus1-0ubuntu122.04-b09
+1 💚javac2m 13sthe patch passed
+1 💚whitespace0m 0sThe patch has no whitespace issues.
+1 💚xml0m 1sThe patch has no ill-formed XML file.
+1 💚javadoc1m 11sthe patch passed with JDK Ubuntu-11.0.19+7-post-Ubuntu-0ubuntu122.04.1
+1 💚javadoc1m 8sthe patch passed with JDK Private Build-1.8.0_362-8u372-gaus1-0ubuntu122.04-b09
_ Other Tests _
-1 ❌unit54m 22sroot in the patch failed.
+1 💚asflicense0m 36sThe patch does not generate ASF License warnings.
119m 3s
ReasonTests
Failed junit teststez.test.TestFaultTolerance
SubsystemReport/Notes
DockerClientAPI=1.43 ServerAPI=1.43 base: https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-287/3/artifact/out/Dockerfile
GITHUB PR#287
JIRA IssueTEZ-4494
Optional Testsdupname asflicense javac javadoc unit xml compile
unameLinux f1fb5593c88d 4.15.0-212-generic #223-Ubuntu SMP Tue May 23 13:09:22 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitypersonality/tez.sh
git revisionmaster / 5038075
Default JavaPrivate Build-1.8.0_362-8u372-gaus1-0ubuntu122.04-b09
Multi-JDK versions/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.19+7-post-Ubuntu-0ubuntu122.04.1 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_362-8u372-gaus1-0ubuntu122.04-b09
unithttps://ci-hadoop.apache.org/job/tez-multibranch/job/PR-287/3/artifact/out/patch-unit-root.txt
Test Resultshttps://ci-hadoop.apache.org/job/tez-multibranch/job/PR-287/3/testReport/
Max. process+thread count2090 (vs. ulimit of 5500)
modulesC: . U: .
Console outputhttps://ci-hadoop.apache.org/job/tez-multibranch/job/PR-287/3/console
versionsgit=2.34.1 maven=3.6.3
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@abstractdog

Copy link
Copy Markdown
Contributor

TestFaultTolerance failures is not related

@abstractdog
abstractdog self-requested a review January 4, 2024 15:13
@abstractdog
abstractdog merged commit 4cba79e into apache:masterJan 4, 2024
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@sercanCyberVision@tez-yetus@abstractdog