security: add dependencyManagement to fix vulnerable transitives

- Pin Jackson to 2.15.3 (fixes multiple CVEs in older versions) - Pin Netty to 4.1.100.Final (fixes CVEs in transport/codec) - Pin Apache Avro to 1.11.4 (fixes deserialization CVEs) - Pin Apache ZooKeeper to 3.9.1 (fixes authentication bypass) - Pin commons-compress to 1.26.0 (fixes zip slip vulnerabilities) - Pin commons-io to 2.15.1 (fixes path traversal) - Pin Guava to 32.1.3-jre (fixes temp directory vulnerabilities) - Pin SnakeYAML to 2.2 (fixes arbitrary code execution) - Pin Jetty to 9.4.53 (fixes multiple HTTP vulnerabilities) - Overrides vulnerable versions from Spark/Hadoop transitives
7 days ago · 7b548be48e
1 changed files with 128 additions and 0 deletions
--- a/test/java/spark/pom.xml
+++ b/test/java/spark/pom.xml
@ -20,8 +20,136 @@
        <hadoop.version>3.3.6</hadoop.version>
        <scala.binary.version>2.12</scala.binary.version>
        <junit.version>4.13.2</junit.version>
        <jackson.version>2.15.3</jackson.version>
        <netty.version>4.1.100.Final</netty.version>
    </properties>
    <!-- Override vulnerable transitive dependencies -->
    <dependencyManagement>
        <dependencies>
            <!-- Jackson - Fix CVEs in older versions -->
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-databind</artifactId>
                <version>${jackson.version}</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-core</artifactId>
                <version>${jackson.version}</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-annotations</artifactId>
                <version>${jackson.version}</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.dataformat</groupId>
                <artifactId>jackson-dataformat-yaml</artifactId>
                <version>${jackson.version}</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.module</groupId>
                <artifactId>jackson-module-scala_${scala.binary.version}</artifactId>
                <version>${jackson.version}</version>
            </dependency>
            <!-- Netty - Fix CVEs in older versions -->
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-all</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-handler</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-transport</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-transport-native-epoll</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-codec</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-codec-http</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <dependency>
                <groupId>io.netty</groupId>
                <artifactId>netty-codec-http2</artifactId>
                <version>${netty.version}</version>
            </dependency>
            <!-- Apache Avro - Fix CVEs -->
            <dependency>
                <groupId>org.apache.avro</groupId>
                <artifactId>avro</artifactId>
                <version>1.11.4</version>
            </dependency>
            <!-- Apache ZooKeeper - Fix CVEs -->
            <dependency>
                <groupId>org.apache.zookeeper</groupId>
                <artifactId>zookeeper</artifactId>
                <version>3.9.1</version>
            </dependency>
            <!-- Apache Commons - Fix CVEs -->
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-compress</artifactId>
                <version>1.26.0</version>
            </dependency>
            <dependency>
                <groupId>commons-io</groupId>
                <artifactId>commons-io</artifactId>
                <version>2.15.1</version>
            </dependency>
            <!-- Guava - Fix CVEs -->
            <dependency>
                <groupId>com.google.guava</groupId>
                <artifactId>guava</artifactId>
                <version>32.1.3-jre</version>
            </dependency>
            <!-- SnakeYAML - Fix CVEs -->
            <dependency>
                <groupId>org.yaml</groupId>
                <artifactId>snakeyaml</artifactId>
                <version>2.2</version>
            </dependency>
            <!-- Jetty - Fix CVEs -->
            <dependency>
                <groupId>org.eclipse.jetty</groupId>
                <artifactId>jetty-server</artifactId>
                <version>9.4.53.v20231009</version>
            </dependency>
            <dependency>
                <groupId>org.eclipse.jetty</groupId>
                <artifactId>jetty-http</artifactId>
                <version>9.4.53.v20231009</version>
            </dependency>
            <dependency>
                <groupId>org.eclipse.jetty</groupId>
                <artifactId>jetty-servlet</artifactId>
                <version>9.4.53.v20231009</version>
            </dependency>
        </dependencies>
    </dependencyManagement>
    <dependencies>
        <!-- Spark Core -->
        <dependency>