Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security Fix: Okio CVE-2023-3635 + OkHttp Jar Update #24473

Merged
merged 1 commit into from
Mar 14, 2025
Merged

Security Fix: Okio CVE-2023-3635 + OkHttp Jar Update #24473

merged 1 commit into from
Mar 14, 2025

Conversation

Mariamalmesfer
Copy link
Contributor

@Mariamalmesfer Mariamalmesfer commented Feb 3, 2025 •
edited by ZacBlanco
Loading

Description

This PR fixes the Okio security vulnerability (CVE-2023-3635) by upgrading from version 1.17.2 to 3.6.0. It also includes an update to the OkHttp jar from 3.9.0 to 4.12.0

Motivation and Context

A flaw was found in Okio’s GzipSource class that doesn’t handle exceptions properly, allowing potential Denial of Service (DoS) attacks with malformed files.

CVE-2023-3635: Details

Impact

Image Scan showed the vulnerability have been removed.
correlation-report-ibm-lh-presto-okie check.csv

Test Plan

Contributor checklist

  • Please make sure your submission complies with our development, formatting, commit message, and attribution guidelines.
  • PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
  • Documented new properties (with its default value), SQL syntax, functions, or other functionality.
  • If release notes are required, they follow the release notes guidelines.
  • Adequate tests were added if applicable.
  • CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

 == RELEASE NOTES ==
Security Changes
* Upgrade okio to 3.6.0 in response to `CVE-2023-3635 <https://github.com/advisories/GHSA-w33c-445m-f8w7>`. 
* Upgrade okhttp to 4.12.0 in response to `CVE-2023-3635 <https://github.com/advisories/GHSA-w33c-445m-f8w7>`.

@prestodb-ci prestodb-ci added the from:IBM PR from IBM label Feb 3, 2025
@Mariamalmesfer Mariamalmesfer force-pushed the okie-fix-test branch 3 times, most recently from bf152d0 to 3ff2d81 Compare February 3, 2025 13:07
@Mariamalmesfer Mariamalmesfer changed the title test Security Fix: Okio CVE-2023-3635 + OkHttp Jar Update Feb 3, 2025
@Mariamalmesfer Mariamalmesfer marked this pull request as ready for review February 3, 2025 15:20
@Mariamalmesfer Mariamalmesfer requested a review from a team as a code owner February 3, 2025 15:20
@steveburnett
Copy link
Contributor

Thanks for the release note!

New release note guidelines: as of last week PR #24354 automatically adds links to this PR to the release notes. Please remove the manual PR link in the following format from the release note entries for this PR.

:pr:`12345`

I have updated the Release Notes Guidelines to remove the examples of manually adding the PR link.

@Mariamalmesfer Mariamalmesfer mentioned this pull request Feb 3, 2025
Merged
@Mariamalmesfer Mariamalmesfer force-pushed the okie-fix-test branch 2 times, most recently from eceb4b9 to ff135ba Compare February 4, 2025 13:07
ZacBlanco
ZacBlanco requested changes Feb 4, 2025
View reviewed changes
presto-jdbc/pom.xml
<relocation>
<pattern>org.jetbrains.annotations</pattern>
<shadedPattern>${shadeBase}.org.jetbrains.annotations</shadedPattern>
</relocation>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@arhimondr Can you confirm that this is the correct shading you mentioned in this comment: https://github.com/prestodb/presto/pull/23796/files#r1935889125

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to move kotlin.. Basically try to open the generated jar in the CLI and see if there are any classes outside of the com.facebook.presto package

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@arhimondr Checked the generated jar and found classes in kotlin/, jvmMain/okio/, and commonMain/okio/ outside the com.facebook.presto package. Added relocations for these. Can you check if this is correct?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me

arhimondr
arhimondr reviewed Feb 6, 2025
View reviewed changes
presto-client/pom.xml
<configuration>
<ignoredUnusedDeclaredDependencies>
<!-- This is needed to keep Okio in the build and prevent conflicts with OkHttp and Kotlin dependencies. -->
<ignoredUnusedDeclaredDependency>com.squareup.okio:okio-jvm</ignoredUnusedDeclaredDependency>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice. This is better than a Dummy hack :-)

presto-jdbc/pom.xml
<relocation>
<pattern>org.jetbrains.annotations</pattern>
<shadedPattern>${shadeBase}.org.jetbrains.annotations</shadedPattern>
</relocation>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to move kotlin.. Basically try to open the generated jar in the CLI and see if there are any classes outside of the com.facebook.presto package

@Mariamalmesfer Mariamalmesfer force-pushed the okie-fix-test branch 4 times, most recently from 2a42688 to 9e08525 Compare February 11, 2025 10:10
arhimondr
arhimondr previously approved these changes Feb 14, 2025
View reviewed changes
presto-jdbc/pom.xml
<relocation>
<pattern>org.jetbrains.annotations</pattern>
<shadedPattern>${shadeBase}.org.jetbrains.annotations</shadedPattern>
</relocation>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me

ZacBlanco
ZacBlanco reviewed Mar 3, 2025
View reviewed changes
Copy link
Contributor

@ZacBlanco ZacBlanco left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for all the fixes. One more question

@Mariamalmesfer Mariamalmesfer force-pushed the okie-fix-test branch 5 times, most recently from 981a91f to 802b81f Compare March 9, 2025 22:18
ZacBlanco
ZacBlanco requested changes Mar 10, 2025
View reviewed changes
Copy link
Contributor

@ZacBlanco ZacBlanco left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you please remove analyze.txt and dependency-tree.txt files?

@Mariamalmesfer
Copy link
Contributor Author

Can you please remove analyze.txt and dependency-tree.txt files?

Done, sorry about that!

ZacBlanco
ZacBlanco previously approved these changes Mar 11, 2025
View reviewed changes
Copy link
Contributor

@ZacBlanco ZacBlanco left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the changes @Mariamalmesfer.

@arhimondr Let us know if you have some bandwidth and want to take another look. Otherwise we will look for another committer to get this merged - Thanks!

@ZacBlanco ZacBlanco requested a review from yingsu00 March 12, 2025 18:16
@yingsu00 yingsu00 merged commit edb4b53 into prestodb:master Mar 14, 2025
96 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ZacBlanco ZacBlanco ZacBlanco approved these changes

@yingsu00 yingsu00 yingsu00 approved these changes

@arhimondr arhimondr arhimondr left review comments

@presto-oss presto-oss Awaiting requested review from presto-oss presto-oss is a code owner automatically assigned from prestodb/committers

Assignees
No one assigned
Labels
from:IBM PR from IBM
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@Mariamalmesfer @steveburnett @ZacBlanco @arhimondr @yingsu00 @prestodb-ci