Resolving jackson-mapper-asl vulnerability

[KarthikaPKumar]

Description

Identified security vulnerability issues of severity high from jackson-mapper-asl and resolved the same.
Excluded the transitive dependency of jackson-mapper-asl occuring from parent packages that does not break the build or impact the functionality but removes the said exploitable.

Motivation and Context

Vulnerabilities Direct vulnerabilities:
CVE-2019-10202
CVE-2019-10172

Impact

A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.

Test Plan

Contributor checklist

• Please make sure your submission complies with our development, formatting, commit message, and attribution guidelines.
• PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
• Documented new properties (with its default value), SQL syntax, functions, or other functionality.
• If release notes are required, they follow the release notes guidelines.
• Adequate tests were added if applicable.
• CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== NO RELEASE NOTE ==

[prestodb-ci]

Saved that user @KarthikaPKumar is from IBM

[auden-woolfson]

LGTM

[agrawalreetika]

@KarthikaPKumar I just tried to look the dependency tree of presto-hive & presto-hive-hadoop2 but I couldn't find org.codehaus.jackson:org.codehaus.jackson in there.

Could you please confirm me, how did you check for it?

[pratyakshsharma]

@KarthikaPKumar can you please respond to above question?

[KarthikaPKumar]

@KarthikaPKumar I just tried to look the dependency tree of presto-hive & presto-hive-hadoop2 but I couldn't find org.codehaus.jackson:org.codehaus.jackson in there.

Could you please confirm me, how did you check for it?

Hi @agrawalreetika
Since it is a transitive dependency. You will have to use maven dependency tree and pinpoint the source jar and run it through the scan to get the path. Or simply remove the exclusion and try checking in the dependency tree.

[pratyakshsharma]

The dependency tree does not show this transitive dependency, I tried checking on master branch @KarthikaPKumar. Can you try running and share a screenshot if possible? Probably this dependency is deep down into the tree and is not showing. Running through the scan seems to be the only way to see it.