Fix CVE-2025-58057 by nathaliellenaa · Pull Request #4338 · opensearch-project/ml-commons

nathaliellenaa · 2025-10-22T22:53:10Z

Description

Fix CVE-2025-58057

Force netty-codec to 4.1.125.Final

for project in opensearch-ml-algorithms opensearch-ml-client opensearch-ml-common opensearch-ml-memory opensearch-ml-plugin opensearch-ml-search-processors opensearch-ml-spi; do
  echo "=== $project ==="
  ./gradlew :$project:dependencies | grep netty-codec
done
=== opensearch-ml-algorithms ===
|    +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final
|    |         \--- io.netty:netty-codec:4.1.125.Final (*)
|    +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
|    |         +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |         |    +--- io.netty:netty-codec:4.1.125.Final
|    |         |         \--- io.netty:netty-codec:4.1.125.Final (*)
|    |         +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |         |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |         |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    |         +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
|    +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final
|    |         \--- io.netty:netty-codec:4.1.125.Final (*)
|    +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
|         +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|         |    +--- io.netty:netty-codec:4.1.125.Final
|         |         \--- io.netty:netty-codec:4.1.125.Final (*)
|         +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|         |    +--- io.netty:netty-codec:4.1.125.Final (*)
|         |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|         +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
=== opensearch-ml-client ===
=== opensearch-ml-common ===
|    +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final
|    |         \--- io.netty:netty-codec:4.1.125.Final (*)
|    +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
|    +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final
|    |         \--- io.netty:netty-codec:4.1.125.Final (*)
|    +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
|    +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final
|    |         \--- io.netty:netty-codec:4.1.125.Final (*)
|    +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
=== opensearch-ml-memory ===
=== opensearch-ml-plugin ===
|    |    |         +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |    |         |    +--- io.netty:netty-codec:4.1.125.Final
|    |    |         +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |    |         |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |    |         |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    |    |         +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
|    |    |         +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |    |         |    +--- io.netty:netty-codec:4.1.125.Final
|    |    |         +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |    |         |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |    |         |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    |    |         +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
=== opensearch-ml-search-processors ===
=== opensearch-ml-spi ===

Couldn't find dependency insight for netty-codec-compression

for project in opensearch-ml-algorithms opensearch-ml-client opensearch-ml-common opensearch-ml-memory opensearch-ml-plugin opensearch-ml-search-processors opensearch-ml-spi; do
  echo "=== $project ==="
  ./gradlew :$project:dependencies | grep netty-codec-compression
done

=== opensearch-ml-algorithms ===
=== opensearch-ml-client ===
=== opensearch-ml-common ===
=== opensearch-ml-memory ===
=== opensearch-ml-plugin ===
=== opensearch-ml-search-processors ===
=== opensearch-ml-spi ===

Related Issues

Resolves #[Issue number to be closed when this PR is merged]

Check List

New functionality includes testing.
New functionality has been documented.
API changes companion pull request created.
Commits are signed per the DCO using --signoff.
Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

brianf-aws · 2025-10-23T00:06:01Z

Nice helper script ;)

You can make the changes on the root of the build file like this

7c49706

which will iterate over the subprojects opensearch-ml-algorithms opensearch-ml-client opensearch-ml-common opensearch-ml-memory opensearch-ml-plugin opensearch-ml-search-processors opensearch-ml-spi

That way we dont have to wackamole the build file in each subproject

nathaliellenaa · 2025-10-23T00:17:39Z

Nice helper script ;)

You can make the changes on the root of the build file like this

7c49706

which will iterate over the subprojects opensearch-ml-algorithms opensearch-ml-client opensearch-ml-common opensearch-ml-memory opensearch-ml-plugin opensearch-ml-search-processors opensearch-ml-spi

That way we dont have to wackamole the build file in each subproject

Good suggestion! I will apply this

dhrubo-os · 2025-10-23T00:38:06Z

        // Force spotless depending on newer version of guava due to CVE-2023-2976. Remove after spotless upgrades.
        resolutionStrategy.force "com.google.guava:guava:32.1.3-jre"
        resolutionStrategy.force 'org.apache.commons:commons-compress:1.26.0'
+        resolutionStrategy.force 'io.netty:netty-buffer:4.1.125.Final'


Are we really using all these?

We need to include those netty modules, otherwise the build will fail

Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com>

* fix cve Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> * Force version for other netty modules Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> * Apply suggestion Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> * Use versions.netty Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> --------- Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> (cherry picked from commit eec7179)

* fix cve * Force version for other netty modules * Apply suggestion * Use versions.netty --------- (cherry picked from commit eec7179) Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> Co-authored-by: Nathalie Jonathan <143617992+nathaliellenaa@users.noreply.github.com>

* fix cve Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> * Force version for other netty modules Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> * Apply suggestion Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> * Use versions.netty Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> --------- Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com>

opensearch-trigger-bot · 2026-03-03T01:28:01Z

The backport to 2.19 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.19 2.19
# Navigate to the new working tree
cd .worktrees/backport-2.19
# Create a new branch
git switch --create backport/backport-4338-to-2.19
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 eec7179bfdb45629fa10a49f65641e7c0180a22b
# Push it to GitHub
git push --set-upstream origin backport/backport-4338-to-2.19
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.19

Then, create a pull request where the base branch is 2.19 and the compare/head branch is backport/backport-4338-to-2.19.

nathaliellenaa requested review from HenryL27, Zhangxunmt, austintlee, b4sjoo, dhrubo-os, jngz-es, mingshl, model-collapse, pyek-bot, rbhavna, sam-herman, xinyual, ylwu-amzn and zane-neo as code owners October 22, 2025 22:53

nathaliellenaa had a problem deploying to ml-commons-cicd-env-require-approval October 22, 2025 22:55 — with GitHub Actions Failure

nathaliellenaa had a problem deploying to ml-commons-cicd-env-require-approval October 22, 2025 22:55 — with GitHub Actions Error

nathaliellenaa had a problem deploying to ml-commons-cicd-env-require-approval October 22, 2025 22:55 — with GitHub Actions Failure

nathaliellenaa had a problem deploying to ml-commons-cicd-env-require-approval October 22, 2025 23:57 — with GitHub Actions Failure

nathaliellenaa temporarily deployed to ml-commons-cicd-env-require-approval October 23, 2025 00:23 — with GitHub Actions Inactive

brianf-aws approved these changes Oct 23, 2025

View reviewed changes

dhrubo-os reviewed Oct 23, 2025

View reviewed changes

nathaliellenaa had a problem deploying to ml-commons-cicd-env-require-approval October 23, 2025 21:39 — with GitHub Actions Failure

nathaliellenaa added 4 commits October 23, 2025 14:47

fix cve

241f0c5

Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com>

Force version for other netty modules

801daf5

Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com>

Apply suggestion

ac7a429

Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com>

Use versions.netty

1753f60

Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com>

nathaliellenaa force-pushed the CVE-2025-58057 branch from 6d97145 to 1753f60 Compare October 23, 2025 21:47

nathaliellenaa temporarily deployed to ml-commons-cicd-env-require-approval October 23, 2025 21:49 — with GitHub Actions Inactive

brianf-aws mentioned this pull request Oct 23, 2025

Fix agent type update #4341

Merged

5 tasks

jiapingzeng approved these changes Oct 23, 2025

View reviewed changes

peterzhuamazon mentioned this pull request Oct 23, 2025

[AUTO] Increment version to 3.3.2-SNAPSHOT opensearch-project/neural-search#1629

Merged

dhrubo-os approved these changes Oct 23, 2025

View reviewed changes

nathaliellenaa had a problem deploying to ml-commons-cicd-env-require-approval October 23, 2025 23:02 — with GitHub Actions Failure

nathaliellenaa had a problem deploying to ml-commons-cicd-env-require-approval October 23, 2025 23:02 — with GitHub Actions Error

dhrubo-os merged commit eec7179 into opensearch-project:main Oct 23, 2025
10 of 13 checks passed

opensearch-trigger-bot Bot mentioned this pull request Oct 23, 2025

[Backport 3.3] Fix CVE-2025-58057 #4343

Merged

brianf-aws mentioned this pull request Oct 24, 2025

address CVE-2025-58057 opensearch-project/opensearch-remote-metadata-sdk#276

Closed

peterzhuamazon mentioned this pull request Nov 5, 2025

Bump gradle to 9.2.0 and JDK to 25 in non-publishing GHAs opensearch-project/opensearch-protobufs#276

Merged

pyek-bot added the backport 2.19 label Mar 3, 2026

This was referenced Mar 3, 2026

chore: fix CVE-2025-67735 in 2.19 #4686

Closed

Fix CVE 2.19 #4694

Merged

Navigation Menu

Fix CVE-2025-58057 - #4338

Fix CVE-2025-58057#4338
dhrubo-os merged 4 commits into
opensearch-project:mainfrom
nathaliellenaa:CVE-2025-58057

nathaliellenaa commented Oct 22, 2025 •

edited by peterzhuamazon

Loading

Uh oh!

brianf-aws commented Oct 23, 2025

Uh oh!

nathaliellenaa commented Oct 23, 2025

Uh oh!

dhrubo-os Oct 23, 2025

Uh oh!

nathaliellenaa Oct 23, 2025

Uh oh!

Uh oh!

opensearch-trigger-bot Bot commented Mar 3, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

nathaliellenaa commented Oct 22, 2025 • edited by peterzhuamazon Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issues

Check List

Uh oh!

brianf-aws commented Oct 23, 2025

Uh oh!

nathaliellenaa commented Oct 23, 2025

Uh oh!

dhrubo-os Oct 23, 2025

Choose a reason for hiding this comment

Uh oh!

nathaliellenaa Oct 23, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

opensearch-trigger-bot Bot commented Mar 3, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

nathaliellenaa commented Oct 22, 2025 •

edited by peterzhuamazon

Loading