Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security vulnerability fixes and multi arch support #763

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
+68 −18
Open

Security vulnerability fixes and multi arch support #763

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
56918c8
Security vulnerability fixes and multi arch support
sukalpomitra Jun 7, 2024
427ba22
move the libgnutls30 upgrade command to previous line
sukalpomitra Jun 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/workflows/build-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,9 @@ jobs:
-
name: Checkout
uses: actions/checkout@v2
-
name: Set up QEMU
uses: docker/setup-qemu-action@v2
-
name: Download war artifact
uses: actions/download-artifact@v2
Expand Down Expand Up @@ -79,6 +82,7 @@ jobs:
uses: docker/build-push-action@v2
with:
context: .
platforms: linux/amd64,linux/arm64
push: ${{ github.event_name != 'pull_request' }}
tags: ${{ steps.metadata.outputs.tags }}
labels: ${{ steps.metadata.outputs.labels }}
1 change: 1 addition & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@ RUN apt-get update && \
tesseract-ocr-sqi \
&& apt-get clean && \
rm -rf /var/lib/apt/lists/*
RUN apt-get update && apt-get upgrade libgnutls30 -y -q
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you merge this with the previous command?
Also, what is this package for?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hi @jendib libgnutls30 is a package in the GnuTLS library suite, specifically version 3. GnuTLS is a secure communications library implementing the SSL, TLS, and DTLS protocols. The primary purpose of libgnutls30 is to provide support for cryptographic algorithms and protocols necessary to secure network communications.

I think this package is used by the OS internally in the version used as it popped in the security vulnerability.

libgnutls.csv

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also merged the command to above line

RUN dpkg-reconfigure -f noninteractive tzdata

# Install Jetty
Expand Down
11 changes: 8 additions & 3 deletions docs-core/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,13 +63,13 @@
</dependency>

<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
</dependency>

<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<artifactId>slf4j-reload4j</artifactId>
jendib marked this conversation as resolved.
Show resolved Hide resolved
</dependency>

<dependency>
Expand Down Expand Up @@ -158,6 +158,11 @@
<artifactId>fr.opensagres.poi.xwpf.converter.pdf</artifactId>
</dependency>

<dependency>
<groupId>xerces</groupId>
<artifactId>xercesImpl</artifactId>
</dependency>

<!-- ImageIO plugins -->
<dependency>
<groupId>com.twelvemonkeys.imageio</groupId>
Expand Down
9 changes: 7 additions & 2 deletions docs-web-common/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,11 @@
<groupId>org.glassfish.jersey.media</groupId>
<artifactId>jersey-media-json-processing</artifactId>
</dependency>

<dependency>
<groupId>org.eclipse.parsson</groupId>
<artifactId>parsson</artifactId>
</dependency>

<!-- Other external dependencies -->
<dependency>
Expand All @@ -49,8 +54,8 @@
</dependency>

<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
</dependency>

<dependency>
Expand Down
9 changes: 7 additions & 2 deletions docs-web/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,11 @@
<groupId>org.glassfish.jersey.inject</groupId>
<artifactId>jersey-hk2</artifactId>
</dependency>

<dependency>
<groupId>org.eclipse.parsson</groupId>
<artifactId>parsson</artifactId>
</dependency>

<!-- Other external dependencies -->
<dependency>
Expand All @@ -64,8 +69,8 @@
</dependency>

<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
</dependency>

<dependency>
Expand Down
51 changes: 41 additions & 10 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,18 +16,19 @@
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

<!-- Dependencies version (external) -->
<org.apache.commons.commons-compress.version>1.22</org.apache.commons.commons-compress.version>
<org.apache.commons.commons-compress.version>1.25.0</org.apache.commons.commons-compress.version>
<org.apache.commons.commons-lang3.version>3.12.0</org.apache.commons.commons-lang3.version>
<commons-io.commons-io.version>2.11.0</commons-io.commons-io.version>
<org.apache.commons.commons-email.version>1.5</org.apache.commons.commons-email.version>
<org.freemarker.freemarker.version>2.3.32</org.freemarker.freemarker.version>
<com.google.guava.guava.version>31.1-jre</com.google.guava.guava.version>
<log4j.log4j.version>1.2.17</log4j.log4j.version>
<com.google.guava.guava.version>33.0.0-jre</com.google.guava.guava.version>
<log4j.log4j.version>2.22.1</log4j.log4j.version>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here the log4j version is upgraded to the major version 2, and reload4j is a log4j 1 fork, so there is a problem.

<org.slf4j.version>1.7.30</org.slf4j.version>
<org.slf4j-reload4j.version>2.0.11</org.slf4j-reload4j.version>
<org.slf4j.jcl-over-slf4j.version>1.7.30</org.slf4j.jcl-over-slf4j.version>
<org.slf4j.jul-to-slf4j.version>1.7.30</org.slf4j.jul-to-slf4j.version>
<junit.junit.version>4.13.2</junit.junit.version>
<com.h2database.h2.version>1.4.199</com.h2database.h2.version>
<com.h2database.h2.version>2.2.224</com.h2database.h2.version>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is going to break all existing instances using h2 database.

Copy link
Contributor Author

@sukalpomitra sukalpomitra Sep 8, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @jendib we have been working with this version of h2 in our forked teedy without any issues. However let me know and I can revert both this and the log4j version change. But there will still be vulnerabilities for these older versions

<jakarta.json.jakarta.json-api.version>2.1.1</jakarta.json.jakarta.json-api.version>
<at.favre.lib.bcrypt.version>0.10.2</at.favre.lib.bcrypt.version>
<org.apache.lucene.version>8.7.0</org.apache.lucene.version>
Expand All @@ -37,6 +38,7 @@
<joda-time.joda-time.version>2.12.2</joda-time.joda-time.version>
<org.hibernate.hibernate.version>6.3.1.Final</org.hibernate.hibernate.version>
<fr.opensagres.xdocreport.version>2.0.4</fr.opensagres.xdocreport.version>
<xerces.xercesImpl.version>2.12.2</xerces.xercesImpl.version>
<net.java.dev.jna.jna.version>5.13.0</net.java.dev.jna.jna.version>
<com.twelvemonkeys.imageio.version>3.9.4</com.twelvemonkeys.imageio.version>
<com.levigo.jbig2.levigo-jbig2-imageio.version>2.0</com.levigo.jbig2.levigo-jbig2-imageio.version>
Expand All @@ -45,11 +47,12 @@
<org.subethamail.subethasmtp-wiser.version>1.2</org.subethamail.subethasmtp-wiser.version>
<com.icegreen.greenmail.version>1.6.14</com.icegreen.greenmail.version>
<org.jsoup.jsoup.version>1.15.4</org.jsoup.jsoup.version>
<com.squareup.okhttp3.okhttp.version>4.10.0</com.squareup.okhttp3.okhttp.version>
<com.squareup.okhttp3.okhttp.version>4.12.0</com.squareup.okhttp3.okhttp.version>
<org.apache.directory.api.version>2.1.3</org.apache.directory.api.version>
<org.apache.directory.server.apacheds-all.version>2.0.0.AM27</org.apache.directory.server.apacheds-all.version>

<org.glassfish.jersey.version>3.0.10</org.glassfish.jersey.version>
<org.glassfish.jersey.version>3.1.5</org.glassfish.jersey.version>
<parsson.version>1.1.5</parsson.version>
<jakarta.servlet.jakarta.servlet-api.version>5.0.0</jakarta.servlet.jakarta.servlet-api.version>
<org.eclipse.jetty.jetty-server.version>11.0.20</org.eclipse.jetty.jetty-server.version>
<org.eclipse.jetty.jetty-webapp.version>11.0.20</org.eclipse.jetty.jetty-webapp.version>
Expand Down Expand Up @@ -219,15 +222,15 @@
</dependency>

<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>${log4j.log4j.version}</version>
</dependency>

<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<version>${org.slf4j.version}</version>
<artifactId>slf4j-reload4j</artifactId>
<version>${org.slf4j-reload4j.version}</version>
</dependency>

<dependency>
Expand Down Expand Up @@ -270,6 +273,12 @@
<groupId>org.glassfish.jersey.media</groupId>
<artifactId>jersey-media-json-processing</artifactId>
<version>${org.glassfish.jersey.version}</version>
<exclusions>
jendib marked this conversation as resolved.
Show resolved Hide resolved
<exclusion>
<groupId>org.eclipse.parsson</groupId>
<artifactId>parsson</artifactId>
</exclusion>
</exclusions>
</dependency>

<dependency>
Expand Down Expand Up @@ -315,6 +324,12 @@
<version>${org.glassfish.jersey.version}</version>
</dependency>

<dependency>
<groupId>org.eclipse.parsson</groupId>
<artifactId>parsson</artifactId>
<version>${parsson.version}</version>
</dependency>

<dependency>
<groupId>jakarta.json</groupId>
<artifactId>jakarta.json-api</artifactId>
Expand Down Expand Up @@ -403,6 +418,12 @@
<groupId>fr.opensagres.xdocreport</groupId>
<artifactId>fr.opensagres.odfdom.converter.pdf</artifactId>
<version>${fr.opensagres.xdocreport.version}</version>
<exclusions>
jendib marked this conversation as resolved.
Show resolved Hide resolved
<exclusion>
<groupId>xerces</groupId>
<artifactId>xercesImpl</artifactId>
</exclusion>
</exclusions>
</dependency>

<dependency>
Expand All @@ -411,6 +432,12 @@
<version>${fr.opensagres.xdocreport.version}</version>
</dependency>

<dependency>
<groupId>xerces</groupId>
<artifactId>xercesImpl</artifactId>
<version>${xerces.xercesImpl.version}</version>
</dependency>

<dependency>
<groupId>org.subethamail</groupId>
jendib marked this conversation as resolved.
Show resolved Hide resolved
<artifactId>subethasmtp-wiser</artifactId>
Expand All @@ -420,6 +447,10 @@
<groupId>javax.mail</groupId>
<artifactId>mail</artifactId>
</exclusion>
<exclusion>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
</exclusions>
</dependency>

Expand Down