Fix CVE-2024-47554: commons-io:commons-io:jar:2.7:compile

doc/changes/changes_2.1.2.md

@@ -0,0 +1,33 @@
+# Bucketfs Client 2.1.2, released 2024-11-18
+
+Code name: Fix CVE-2024-47554: commons-io:commons-io:jar:2.7:compile
+
+## Summary
+
+This release fixes CVE-2024-47554 in `commons-io:commons-io:jar:2.7:compile`.
+
+## Security
+
+* #44: Fixed CVE-2024-47554 in `commons-io:commons-io:jar:2.7:compile`
+
+## Dependency Updates
+
+### Compile Dependency Updates
+
+* Updated `com.exasol:bucketfs-java:3.1.2` to `3.2.1`
+* Updated `com.github.vincentrussell:java-ini-parser:1.6` to `1.7`
+* Added `commons-io:commons-io:2.17.0`
+* Added `org.apache.commons:commons-lang3:3.17.0`
+
+### Test Dependency Updates
+
+* Updated `com.exasol:exasol-testcontainers:7.1.0` to `7.1.1`
+* Updated `nl.jqno.equalsverifier:equalsverifier:3.16.1` to `3.17.3`
+* Updated `org.hamcrest:hamcrest:2.2` to `3.0`
+* Updated `org.itsallcode:junit5-system-extensions:1.2.0` to `1.2.2`
+* Updated `org.junit-pioneer:junit-pioneer:2.2.0` to `2.3.0`
+* Updated `org.junit.jupiter:junit-jupiter-params:5.10.2` to `5.11.3`
+* Updated `org.junit.jupiter:junit-jupiter:5.10.2` to `5.11.3`
+* Updated `org.mockito:mockito-junit-jupiter:5.11.0` to `5.14.2`
+* Updated `org.slf4j:slf4j-jdk14:2.0.13` to `2.0.16`
+* Updated `org.testcontainers:junit-jupiter:1.19.7` to `1.20.3`

pom.xml

@@ -2,12 +2,12 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <artifactId>bucketfs-client</artifactId>
-    <version>2.1.1</version>
+    <version>2.1.2</version>
     <description>Command line client for BucketFS</description>
     <url>https://github.com/exasol/bucketfs-client/</url>
     <properties>
         <java.version>17</java.version>
-        <junit.version>5.10.2</junit.version>
+        <junit.version>5.11.3</junit.version>
         <picocli.version>4.7.6</picocli.version>
     </properties>
     <profiles>
@@ -28,7 +28,7 @@
         <dependency>
             <groupId>com.exasol</groupId>
             <artifactId>bucketfs-java</artifactId>
-            <version>3.1.2</version>
+            <version>3.2.1</version>
         </dependency>
         <dependency>
             <groupId>com.exasol</groupId>
@@ -43,7 +43,19 @@
         <dependency>
             <groupId>com.github.vincentrussell</groupId>
             <artifactId>java-ini-parser</artifactId>
-            <version>1.6</version>
+            <version>1.7</version>
+        </dependency>
+        <dependency>
+            <!-- Update transitive dependency to fix CVE-2024-47554 -->
+            <groupId>commons-io</groupId>
+            <artifactId>commons-io</artifactId>
+            <version>2.17.0</version>
+        </dependency>
+        <dependency>
+            <!-- Update transitive dependency because exasol-testcontainers requires newer version -->
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.17.0</version>
         </dependency>
         <!-- test dependencies -->
         <dependency>
@@ -61,50 +73,50 @@
         <dependency>
             <groupId>org.hamcrest</groupId>
             <artifactId>hamcrest</artifactId>
-            <version>2.2</version>
+            <version>3.0</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-junit-jupiter</artifactId>
-            <version>5.11.0</version>
+            <version>5.14.2</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>com.exasol</groupId>
             <artifactId>exasol-testcontainers</artifactId>
-            <version>7.1.0</version>
+            <version>7.1.1</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.testcontainers</groupId>
             <artifactId>junit-jupiter</artifactId>
-            <version>1.19.7</version>
+            <version>1.20.3</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>nl.jqno.equalsverifier</groupId>
             <artifactId>equalsverifier</artifactId>
-            <version>3.16.1</version>
+            <version>3.17.3</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.itsallcode</groupId>
             <artifactId>junit5-system-extensions</artifactId>
-            <version>1.2.0</version>
+            <version>1.2.2</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.junit-pioneer</groupId>
             <artifactId>junit-pioneer</artifactId>
-            <version>2.2.0</version>
+            <version>2.3.0</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <!-- Enable testcontainers log output for integration tests -->
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-jdk14</artifactId>
-            <version>2.0.13</version>
+            <version>2.0.16</version>
             <scope>test</scope>
         </dependency>
     </dependencies>
@@ -178,7 +190,7 @@
     <parent>
         <artifactId>bucketfs-client-generated-parent</artifactId>
         <groupId>com.exasol</groupId>
-        <version>2.1.1</version>
+        <version>2.1.2</version>
         <relativePath>pk_generated_parent.pom</relativePath>
     </parent>
 </project>

src/test/java/com/exasol/bucketfs/ProcessExecutor.java

@@ -21,7 +21,7 @@ public class ProcessExecutor {
     private static final Duration TIMEOUT = Duration.ofSeconds(5);
 
     /** Name of the JAR file */
-    public static final String JAR_NAME = "bfsc-2.1.1.jar";
+    public static final String JAR_NAME = "bfsc-2.1.2.jar";
 
     /**
      * Create a {@link ProcessExecutor} for the jar built by for the current projects. The Jar file must be built before
@@ -73,9 +73,8 @@ public ProcessExecutor workingDirectory(final Path workingDir) {
      * @param args additional command line arguments for execution
      * @return this for fluent programming
      * @throws IOException          in case of errors
-     * @throws InterruptedException in case process was interrupted
      */
-    public ProcessExecutor run(final String... args) throws IOException, InterruptedException {
+    public ProcessExecutor run(final String... args) throws IOException {
         final List<String> commandLine = new ArrayList<>(asList(this.initialArgs));
         commandLine.addAll(asList(args));
         final File directory = Optional.ofNullable(workingDir).map(Path::toAbsolutePath).map(Path::toFile).orElse(null);