Security Vulnerability fix for snappy-0.2(CVE-2024-36124) by namya28 · Pull Request #24159 · prestodb/presto

namya28 · 2024-11-27T09:45:09Z

Description

This PR is fixing the security vulnerability for the library "snappy-0.2" (CVE-2024-36124) https://mvnrepository.com/artifact/org.iq80.snappy/snappy/0.2. The library has been upgraded to the version 0.5 (https://mvnrepository.com/artifact/org.iq80.snappy/snappy/0.5). This fixes CVE-2024-36124.

Motivation and Context

The snappy library currently used has a security vulnerability for the version 0.2. This PR focuses on upgrading the version to 0.5 to fix the current vulnerability.

Impact

Test Plan

Contributor checklist

Please make sure your submission complies with our contributing guide, in particular code style and commit standards.
PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
Documented new properties (with its default value), SQL syntax, functions, or other functionality.
If release notes are required, they follow the release notes guidelines.
Adequate tests were added if applicable.
CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

Security Changes

* Upgrade the snappy version to 0.5 in response to `CVE-2024-36124 <https://github.com/advisories/GHSA-8wh2-6qhj-h7j9>`_. :pr:`24159`

linux-foundation-easycla · 2024-11-27T12:58:26Z

The committers listed above are authorized under a signed CLA.

✅ login: namya28 / name: Namya Sehgal (f6e2e60)

infvg · 2024-11-27T18:01:32Z

presto-hive/pom.xml

+                <exclusion>
+                    <groupId>org.iq80.snappy</groupId>
+                    <artifactId>snappy</artifactId>
+                </exclusion>


Why are we excluding this?

There was an upper bound dependencies error for org.iq80.snappy:snappy:0.2 from this module(Attaching below for reference) :

+-com.facebook.presto:presto-hive:0.291-SNAPSHOT
+-com.facebook.hive:hive-dwrf:0.8.5
+-org.iq80.snappy:snappy:0.2
and
+-com.facebook.presto:presto-hive:0.291-SNAPSHOT
+-com.facebook.presto:presto-hive-metastore:0.291-SNAPSHOT
+-org.iq80.snappy:snappy:0.5
and
+-com.facebook.presto:presto-hive:0.291-SNAPSHOT
+-com.facebook.presto:presto-hive-metastore:0.291-SNAPSHOT
+-org.iq80.snappy:snappy:0.5

infvg · 2024-11-27T18:02:19Z

presto-hive-hadoop2/pom.xml

+            <artifactId>snappy</artifactId>
+            <version>0.5</version>
+        </dependency>
+


Instead of bringing in this dependency, have you tried adding this upgrade to the root pom dependency management?

This was a transitive dependency coming from this module. I will try adding in the root pom as well. Thanks for the suggestion.

infvg · 2024-11-27T18:05:06Z

Could you please squash the commits and modify the commit message to follow the guidelines?

The release note should also contain the CVE as per the guidelines
eg:
* Upgrade okio to 3.6.0 in response to `CVE-2023-3635 <https://github.com/advisories/GHSA-w33c-445m-f8w7>`_. :pr:`23796

infvg · 2024-11-27T18:05:55Z

presto-hive-metastore/pom.xml

+            <artifactId>snappy</artifactId>
+            <version>0.5</version>
+        </dependency>
+


Could we also get this in the root pom?

This upgrade eliminates the vulnerability present in the version 0.2 which fixes CVE-2024-36124.

namya28 · 2024-11-28T16:57:35Z

Hi @infvg , thank you for your suggestions and comments. I have addressed all the review comments. Could you please re-review the PR once again.

infvg

LGTM

nishithakbhaskaran

Looks good

tdcmeehan · 2024-12-04T15:35:50Z

pom.xml


    <dependencyManagement>
        <dependencies>
+            <dependency>


What is ultimately bringing in and using this dependency?

@tdcmeehan The version earlier used was 0.2 which was present transitively across modules , causing the vulnerability. By bringing in this dependency and the version 0.5 fixes the vulnerability as 0.5 is the vulnerable free version for this library.

Right, but my question is what is using it?

It is being transitively used by the modules presto-hive-hadoop2 , presto-hive , presto-native-execution and presto-hive-metastore . (Attaching a screenshot for reference)

Should we update hive-dwrf instead of overriding it at the top level here?

@tdcmeehan , introducing the latest version of hive-dwrf introduces a lot of vulnerabilities. (https://mvnrepository.com/artifact/com.facebook.hive/hive-dwrf/0.18.9). (Attaching the screenshot from the maven repository). Although even if we try upgrading hive-dwrf, it does not resolve the vulnerability directly as it still introduces the 0.2 version of snappy transitively.

@tdcmeehan , could you please have a look at the comments and re-review if possible?

What I mean is, simply fix the vulnerabilities in hive-dwrf, cut a release, then update here. https://github.com/prestodb/presto-hive-dwrf

namya28 · 2025-02-25T08:39:19Z

Closing this PR as this CVE was fixed by upgrading the snappy version in the new hive-dwrf release.
Attaching the PRs:
The PR Link to prestodb/presto: #24461
The PR link to upgrade snappy in prestodb/presto-hive-dwrf : prestodb/presto-hive-dwrf#7

prestodb-ci added the from:IBM PR from IBM label Nov 27, 2024

prestodb-ci requested review from a team, infvg and nishithakbhaskaran and removed request for a team November 27, 2024 09:45

namya28 force-pushed the snappy_vulfix branch from 5d227f4 to 5034f5a Compare November 27, 2024 13:03

infvg reviewed Nov 27, 2024

View reviewed changes

Upgrade the snappy version to 0.5

f6e2e60

This upgrade eliminates the vulnerability present in the version 0.2 which fixes CVE-2024-36124.

namya28 force-pushed the snappy_vulfix branch from 26b240f to f6e2e60 Compare November 28, 2024 15:49

namya28 requested a review from infvg November 28, 2024 16:57

namya28 marked this pull request as ready for review November 28, 2024 16:58

namya28 requested a review from a team as a code owner November 28, 2024 16:58

namya28 requested a review from presto-oss November 28, 2024 16:58

infvg approved these changes Nov 30, 2024

View reviewed changes

nishithakbhaskaran approved these changes Dec 2, 2024

View reviewed changes

tdcmeehan reviewed Dec 4, 2024

View reviewed changes

namya28 requested a review from tdcmeehan December 10, 2024 08:27

namya28 closed this Feb 25, 2025

Conversation

namya28 commented Nov 27, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Motivation and Context

Impact

Test Plan

Contributor checklist

Release Notes

Uh oh!

linux-foundation-easycla bot commented Nov 27, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

infvg commented Nov 27, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

namya28 commented Nov 28, 2024

Uh oh!

infvg left a comment

Choose a reason for hiding this comment

Uh oh!

nishithakbhaskaran left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

namya28 Dec 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

namya28 Dec 5, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

namya28 commented Feb 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

namya28 commented Nov 27, 2024 •

edited

Loading

linux-foundation-easycla bot commented Nov 27, 2024 •

edited

Loading

infvg commented Nov 27, 2024 •

edited

Loading

namya28 Dec 4, 2024 •

edited

Loading

namya28 Dec 5, 2024 •

edited

Loading