[adarshsanjeev]

The vulnerability is in a builtin function in Calcite, EXTRACT_VALUE, which is not exposed in the Druid console, so druid should be unaffected.

• Suppress calcite CVE.

---

This PR has:

• been self-reviewed.
  • using the concurrency checklist (Remove this item if the PR doesn't have any relation to concurrency.)
• added documentation for new or modified features or behaviors.
• added Javadocs for most classes and all non-trivial methods. Linked related entities via Javadoc links.
• added or updated version, license, or notice information in licenses.yaml
• added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader.
• added unit tests or modified existing tests to cover new code paths, ensuring the threshold for code coverage is met.
• added integration tests.
• been tested in a test Druid cluster.

[kfaraz]

The vulnerability is in calcite-core. Does it need to be suppressed for avatica-server too?

[adarshsanjeev]

I believe calcite is used by avatica server too, wouldn't it need to be suppressed separately?

[kfaraz]

I don't think so. Could you try running the security check without the extra suppression?

[abhishekagarwal87]

the failure is being reported for avatica-server as well.

[ERROR] ----------------------------------------------------
[ERROR] .NET Assembly Analyzer could not be initialized and at least one 'exe' or 'dll' was scanned. The 'dotnet' executable could not be found on the path; either disable the Assembly Analyzer or add the path to dotnet core in the configuration.
[ERROR] ----------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:7.0.4:aggregate (default-cli) on project druid: 
[ERROR] 
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0': 
[ERROR] 
[ERROR] avatica-server-1.17.0.jar: CVE-2022-39135(9.8)
[ERROR] calcite-core-1.21.0.jar: CVE-2022-39135(9.8)
[ERROR] 
[ERROR] See the dependency-check report for more details.
[ERROR] -> [Help 1]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException