Security update - fix for CVE-2024-36114 (#167)

* Security update - fix for CVE-2024-36114
exasol · Jun 4, 2024 · 0a5b729 · 0a5b729
1 parent 6748d4c
commit 0a5b729
Show file tree

Hide file tree

Showing 13 changed files with 66 additions and 42 deletions.
diff --git a/.github/workflows/broken_links_checker.yml b/.github/workflows/broken_links_checker.yml
diff --git a/.github/workflows/ci-build-next-java.yml b/.github/workflows/ci-build-next-java.yml
diff --git a/.github/workflows/ci-build.yml b/.github/workflows/ci-build.yml
diff --git a/.github/workflows/dependencies_update.yml b/.github/workflows/dependencies_update.yml
diff --git a/dependencies.md b/dependencies.md
diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md
diff --git a/doc/changes/changes_3.0.7.md b/doc/changes/changes_3.0.7.md
@@ -0,0 +1,33 @@
+# S3 Document Files Virtual Schema 3.0.7, released 2024-06-04
+
+Code name: Security update - fix for CVE-2024-36114
+
+## Summary
+
+Fixed CVE-2024-36114  https://github.com/advisories/GHSA-973x-65j7-xcf4.
+
+## Security
+
+* #166: CVE-2024-36114: io.airlift:aircompressor:jar:0.21:compile
+
+## Dependency Updates
+
+### Virtual Schema for Document Data in Files on AWS S3
+
+#### Compile Dependency Updates
+
+* Updated `com.exasol:virtual-schema-common-document-files:8.0.3` to `8.0.4`
+
+#### Test Dependency Updates
+
+* Updated `com.exasol:virtual-schema-common-document-files:8.0.3` to `8.0.4`
+* Updated `org.jacoco:org.jacoco.agent:0.8.11` to `0.8.12`
+
+#### Plugin Dependency Updates
+
+* Updated `com.exasol:error-code-crawler-maven-plugin:2.0.2` to `2.0.3`
+* Updated `com.exasol:project-keeper-maven-plugin:4.3.0` to `4.3.2`
+* Updated `org.apache.maven.plugins:maven-enforcer-plugin:3.4.1` to `3.5.0`
+* Updated `org.apache.maven.plugins:maven-jar-plugin:3.3.0` to `3.4.1`
+* Updated `org.apache.maven.plugins:maven-toolchains-plugin:3.1.0` to `3.2.0`
+* Updated `org.sonarsource.scanner.maven:sonar-maven-plugin:3.11.0.3922` to `4.0.0.4121`
diff --git a/doc/hands_on/hands_on.md b/doc/hands_on/hands_on.md
@@ -62,7 +62,7 @@ For the document Virtual Schemas, and by that also the S3 Virtual Schema, this i
 To install the Virtual Schema adapter, download its latest jar from the [releases](https://github.com/exasol/s3-document-files-virtual-schema/releases) and upload to BucketFS:
 
 ``` shell script
-curl -I -X PUT -T document-files-virtual-schema-dist-8.0.3-s3-3.0.6.jar http://w:writepw@<YOUR_DB_IP>:2580/default/
+curl -I -X PUT -T document-files-virtual-schema-dist-8.0.4-s3-3.0.7.jar http://w:writepw@<YOUR_DB_IP>:2580/default/
 ```
 
 (If you have never used BucketFS, you can check out [its documentation](https://docs.exasol.com/database_concepts/bucketfs/bucketfs.htm))
@@ -75,7 +75,7 @@ CREATE SCHEMA ADAPTER;
 --/
 CREATE OR REPLACE JAVA ADAPTER SCRIPT ADAPTER.S3_FILES_ADAPTER AS
     %scriptclass com.exasol.adapter.RequestDispatcher;
-    %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-8.0.3-s3-3.0.6.jar;
+    %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-8.0.4-s3-3.0.7.jar;
 /
 
 --/
@@ -85,7 +85,7 @@ CREATE OR REPLACE JAVA SET SCRIPT ADAPTER.IMPORT_FROM_S3_DOCUMENT_FILES(
   CONNECTION_NAME VARCHAR(500))
   EMITS(...) AS
     %scriptclass com.exasol.adapter.document.UdfEntryPoint;
-    %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-8.0.3-s3-3.0.6.jar;
+    %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-8.0.4-s3-3.0.7.jar;
 /
 ```
 

diff --git a/doc/hands_on/hands_on_parquet.md b/doc/hands_on/hands_on_parquet.md
@@ -47,7 +47,7 @@ For the document Virtual Schemas, and by that also the S3 Virtual Schema, this i
 To install the Virtual Schema adapter, download its latest jar from the [releases](https://github.com/exasol/s3-document-files-virtual-schema/releases) and upload to BucketFS:
 
 ``` shell script
-curl -I -X PUT -T document-files-virtual-schema-dist-8.0.3-s3-3.0.6.jar http://w:writepw@<YOUR_DB_IP>:2580/default/
+curl -I -X PUT -T document-files-virtual-schema-dist-8.0.4-s3-3.0.7.jar http://w:writepw@<YOUR_DB_IP>:2580/default/
 ```
 
 (If you have never used BucketFS, you can check out [its documentation](https://docs.exasol.com/database_concepts/bucketfs/bucketfs.htm))
@@ -59,7 +59,7 @@ CREATE SCHEMA ADAPTER;
 
 CREATE OR REPLACE JAVA ADAPTER SCRIPT ADAPTER.S3_FILES_ADAPTER AS
     %scriptclass com.exasol.adapter.RequestDispatcher;
-    %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-8.0.3-s3-3.0.6.jar;
+    %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-8.0.4-s3-3.0.7.jar;
 /
 
 CREATE OR REPLACE JAVA SET SCRIPT ADAPTER.IMPORT_FROM_S3_DOCUMENT_FILES(
@@ -68,7 +68,7 @@ CREATE OR REPLACE JAVA SET SCRIPT ADAPTER.IMPORT_FROM_S3_DOCUMENT_FILES(
   CONNECTION_NAME VARCHAR(500))
   EMITS(...) AS
     %scriptclass com.exasol.adapter.document.UdfEntryPoint;
-    %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-8.0.3-s3-3.0.6.jar;
+    %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-8.0.4-s3-3.0.7.jar;
 /
 ```
 

diff --git a/doc/user_guide/user_guide.md b/doc/user_guide/user_guide.md
@@ -17,7 +17,7 @@ Next create the Adapter Script:
 ```sql
 CREATE OR REPLACE JAVA ADAPTER SCRIPT ADAPTER.S3_FILES_ADAPTER AS
     %scriptclass com.exasol.adapter.RequestDispatcher;
-    %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-8.0.3-s3-3.0.6.jar;
+    %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-8.0.4-s3-3.0.7.jar;
 /
 ```
 
@@ -30,7 +30,7 @@ CREATE OR REPLACE JAVA SET SCRIPT ADAPTER.IMPORT_FROM_S3_DOCUMENT_FILES(
   CONNECTION_NAME VARCHAR(500))
   EMITS(...) AS
     %scriptclass com.exasol.adapter.document.UdfEntryPoint;
-    %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-8.0.3-s3-3.0.6.jar;
+    %jar /buckets/bfsdefault/default/document-files-virtual-schema-dist-8.0.4-s3-3.0.7.jar;
 /
 ```
 
@@ -126,7 +126,7 @@ In DbVisualizer use exactly this command:
 --/
 CREATE OR REPLACE JAVA ADAPTER SCRIPT ADAPTER.S3_FILES_ADAPTER AS
    %scriptclass com.exasol.adapter.RequestDispatcher;
-   %jar /buckets/bfsdefault/default/vs/document-files-virtual-schema-dist-8.0.3-s3-3.0.6.jar;
+   %jar /buckets/bfsdefault/default/vs/document-files-virtual-schema-dist-8.0.4-s3-3.0.7.jar;
 /
 ```
 

diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom
diff --git a/pom.xml b/pom.xml
@@ -2,14 +2,14 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <artifactId>s3-document-files-virtual-schema</artifactId>
-    <version>3.0.6</version>
+    <version>3.0.7</version>
     <name>Virtual Schema for document data in files on AWS S3</name>
     <description>Adapter for document data access from files from AWS S3.</description>
     <url>https://github.com/exasol/s3-document-files-virtual-schema/</url>
     <properties>
         <junit.version>5.10.2</junit.version>
         <org.testcontainers.version>1.19.7</org.testcontainers.version>
-        <vs-common-document-files.version>8.0.3</vs-common-document-files.version>
+        <vs-common-document-files.version>8.0.4</vs-common-document-files.version>
         <!-- Additional sonar configuration for analyzing TypeScript extension -->
         <sonar.sources>src/main/,extension/src/</sonar.sources>
         <sonar.exclusions>extension/src/*.test.ts</sonar.exclusions>
@@ -237,7 +237,7 @@
             <plugin>
                 <groupId>com.exasol</groupId>
                 <artifactId>project-keeper-maven-plugin</artifactId>
-                <version>4.3.0</version>
+                <version>4.3.2</version>
                 <executions>
                     <execution>
                         <goals>
@@ -363,7 +363,7 @@
     <parent>
         <artifactId>s3-document-files-virtual-schema-generated-parent</artifactId>
         <groupId>com.exasol</groupId>
-        <version>3.0.6</version>
+        <version>3.0.7</version>
         <relativePath>pk_generated_parent.pom</relativePath>
     </parent>
 </project>
diff --git a/src/test/java/com/exasol/adapter/document/files/IntegrationTestSetup.java b/src/test/java/com/exasol/adapter/document/files/IntegrationTestSetup.java
@@ -28,7 +28,7 @@
 
 public class IntegrationTestSetup implements AutoCloseable {
     public static final Path CLOUD_SETUP_CONFIG = Path.of("cloudSetup/generated/testConfig.json");
-    public static final String ADAPTER_JAR = "document-files-virtual-schema-dist-8.0.3-s3-3.0.6.jar";
+    public static final String ADAPTER_JAR = "document-files-virtual-schema-dist-8.0.4-s3-3.0.7.jar";
     public static final Path ADAPTER_JAR_LOCAL_PATH = Path.of("target", ADAPTER_JAR);
     public final String s3BucketName;
     private final ExasolTestSetup exasolTestSetup = new ExasolTestSetupFactory(CLOUD_SETUP_CONFIG).getTestSetup();