Skip to content

Commit f540396

Browse files
jorgeepditommaso
jorgee
and
pditommaso
authored
Address Netty CVEs by bumping AWS SDK and excluding micronaut-core-bom from test classpath (#7100)
* fix netty vulnerabilities Signed-off-by: jorgee <jorge.ejarque@seqera.io> * alternatice to version pinning Signed-off-by: jorgee <jorge.ejarque@seqera.io> * Apply suggestion from @pditommaso [ci skip] Signed-off-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com> * Apply suggestion from @pditommaso [ci skip] Signed-off-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com> * Apply suggestion from @pditommaso [ci skip] Signed-off-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com> --------- Signed-off-by: jorgee <jorge.ejarque@seqera.io> Signed-off-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com> Signed-off-by: Jorge Ejarque <jorgee@users.noreply.github.com> Co-authored-by: Paolo Di Tommaso <paolo.ditommaso@gmail.com>
1 parent 6a38ee9 commit f540396

8 files changed

Lines changed: 27 additions & 31 deletions

File tree

‎modules/nextflow/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ dependencies {
7676

7777
testImplementation 'org.subethamail:subethasmtp:3.1.7'
7878
testImplementation (project(':nf-lineage'))
79-
testImplementation 'org.wiremock:wiremock:3.13.1'
79+
testImplementation 'org.wiremock:wiremock:3.13.2'
8080
// test configuration
8181
testFixturesApi ("org.apache.groovy:groovy-test:4.0.31") { exclude group: 'org.apache.groovy' }
8282
testFixturesApi ("org.objenesis:objenesis:3.4")

‎modules/nf-commons/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,6 @@ dependencies {
4545
testFixturesImplementation(project(":nextflow"))
4646

4747
testImplementation "org.apache.groovy:groovy-json:4.0.31" // needed by wiremock
48-
testImplementation ('org.wiremock:wiremock:3.13.1') { exclude module: 'groovy-all' }
48+
testImplementation ('org.wiremock:wiremock:3.13.2') { exclude module: 'groovy-all' }
4949
}
5050

‎modules/nf-httpfs/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ dependencies {
3636

3737
/* testImplementation inherited from top gradle build file */
3838
testImplementation "org.apache.groovy:groovy-json:4.0.31" // needed by wiremock
39-
testImplementation ('org.wiremock:wiremock:3.13.1') { exclude module: 'groovy-all' }
39+
testImplementation ('org.wiremock:wiremock:3.13.2') { exclude module: 'groovy-all' }
4040

4141
testImplementation(testFixtures(project(":nextflow")))
4242
}

‎plugins/nf-amazon/build.gradle‎

Lines changed: 15 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ sourceSets {
4848
configurations {
4949
// see https://docs.gradle.org/4.1/userguide/dependency_management.html#sub:exclude_transitive_dependencies
5050
runtimeClasspath.exclude group: 'org.slf4j', module: 'slf4j-api'
51+
testRuntimeClasspath.exclude group: 'io.micronaut', module: 'micronaut-core-bom'
5152
}
5253

5354
dependencies {
@@ -56,25 +57,20 @@ dependencies {
5657
compileOnly 'org.pf4j:pf4j:3.14.1'
5758

5859
api ('javax.xml.bind:jaxb-api:2.4.0-b180830.0359')
59-
api ('software.amazon.awssdk:s3:2.33.2')
60-
api ('software.amazon.awssdk:ec2:2.33.2')
61-
api ('software.amazon.awssdk:batch:2.33.2')
62-
api ('software.amazon.awssdk:iam:2.33.2')
63-
api ('software.amazon.awssdk:ecs:2.33.2')
64-
api ('software.amazon.awssdk:cloudwatchlogs:2.33.2')
65-
api ('software.amazon.awssdk:codecommit:2.33.2')
66-
api ('software.amazon.awssdk:sts:2.33.2')
67-
api ('software.amazon.awssdk:ses:2.33.2')
68-
api ('software.amazon.awssdk:sso:2.33.2')
69-
api ('software.amazon.awssdk:ssooidc:2.33.2')
70-
api ('software.amazon.awssdk:s3-transfer-manager:2.33.2')
71-
api ('software.amazon.awssdk:apache-client:2.33.2')
72-
api ('software.amazon.awssdk:aws-crt-client:2.33.2')
73-
74-
// address security vulnerabilities
75-
implementation 'io.netty:netty-common:4.1.133.Final'
76-
implementation 'io.netty:netty-handler:4.1.133.Final'
77-
implementation 'io.netty:netty-codec-http2:4.1.133.Final'
60+
api ('software.amazon.awssdk:s3:2.44.3')
61+
api ('software.amazon.awssdk:ec2:2.44.3')
62+
api ('software.amazon.awssdk:batch:2.44.3')
63+
api ('software.amazon.awssdk:iam:2.44.3')
64+
api ('software.amazon.awssdk:ecs:2.44.3')
65+
api ('software.amazon.awssdk:cloudwatchlogs:2.44.3')
66+
api ('software.amazon.awssdk:codecommit:2.44.3')
67+
api ('software.amazon.awssdk:sts:2.44.3')
68+
api ('software.amazon.awssdk:ses:2.44.3')
69+
api ('software.amazon.awssdk:sso:2.44.3')
70+
api ('software.amazon.awssdk:ssooidc:2.44.3')
71+
api ('software.amazon.awssdk:s3-transfer-manager:2.44.3')
72+
api ('software.amazon.awssdk:apache-client:2.44.3')
73+
api ('software.amazon.awssdk:aws-crt-client:2.44.3')
7874

7975
testImplementation(testFixtures(project(":nextflow")))
8076
testImplementation project(':nextflow')

‎plugins/nf-amazon/src/main/nextflow/cloud/aws/nio/S3Client.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
import java.io.InputStream;
2222
import java.io.InterruptedIOException;
2323
import java.nio.file.*;
24+
import java.nio.file.AccessDeniedException;
2425
import java.nio.file.attribute.BasicFileAttributes;
2526
import java.util.EnumSet;
2627
import java.util.Queue;

‎plugins/nf-azure/build.gradle‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,20 +47,21 @@ sourceSets {
4747
configurations {
4848
// see https://docs.gradle.org/4.1/userguide/dependency_management.html#sub:exclude_transitive_dependencies
4949
runtimeClasspath.exclude group: 'org.slf4j', module: 'slf4j-api'
50+
testRuntimeClasspath.exclude group: 'io.micronaut', module: 'micronaut-core-bom'
5051
}
5152

5253
dependencies {
5354
compileOnly project(':nextflow')
5455
compileOnly 'org.slf4j:slf4j-api:2.0.17'
5556
compileOnly 'org.pf4j:pf4j:3.14.1'
56-
api('com.azure:azure-storage-blob:12.33.2') {
57+
api('com.azure:azure-storage-blob:12.33.3') {
5758
exclude group: 'org.slf4j', module: 'slf4j-api'
5859
}
5960
api('com.azure:azure-compute-batch:1.0.0-beta.3') {
6061
exclude group: 'org.slf4j', module: 'slf4j-api'
6162
exclude group: 'com.google.guava', module: 'guava'
6263
}
63-
api('com.azure:azure-identity:1.18.2') {
64+
api('com.azure:azure-identity:1.18.3') {
6465
exclude group: 'org.slf4j', module: 'slf4j-api'
6566
}
6667

‎plugins/nf-codecommit/build.gradle‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ sourceSets {
4343
configurations {
4444
// see https://docs.gradle.org/4.1/userguide/dependency_management.html#sub:exclude_transitive_dependencies
4545
runtimeClasspath.exclude group: 'org.slf4j', module: 'slf4j-api'
46+
testRuntimeClasspath.exclude group: 'io.micronaut', module: 'micronaut-core-bom'
4647
}
4748

4849
dependencies {
@@ -51,12 +52,9 @@ dependencies {
5152
compileOnly 'org.pf4j:pf4j:3.14.1'
5253

5354
api ('javax.xml.bind:jaxb-api:2.4.0-b180830.0359')
54-
api ('software.amazon.awssdk:codecommit:2.31.64')
55-
api ('software.amazon.awssdk:sso:2.31.64')
56-
api ('software.amazon.awssdk:ssooidc:2.31.64')
57-
58-
// address security vulnerabilities
59-
runtimeOnly 'io.netty:netty-codec-http:4.1.133.Final'
55+
api ('software.amazon.awssdk:codecommit:2.44.3')
56+
api ('software.amazon.awssdk:sso:2.44.3')
57+
api ('software.amazon.awssdk:ssooidc:2.44.3')
6058

6159
testImplementation(testFixtures(project(":nextflow")))
6260
testImplementation project(':nextflow')

‎plugins/nf-tower/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ dependencies {
6969
testImplementation "org.apache.groovy:groovy-nio:4.0.31"
7070
testImplementation "org.apache.groovy:groovy-json:4.0.31"
7171
// wiremock required by TowerFusionEnvTest
72-
testImplementation "org.wiremock:wiremock:3.13.1"
72+
testImplementation "org.wiremock:wiremock:3.13.2"
7373
// Address security vulnerabilities CVE-2022-45688 and CVE-2023-5072
7474
testImplementation 'org.json:json:20240303'
7575
}

0 commit comments

Comments
 (0)
⚡