Skip to content

Suppress Calcite CVE #13119

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
abhishekagarwal87 merged 3 commits into from
Sep 23, 2022
Merged

Suppress Calcite CVE #13119

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ac6e1b2
Suppress Calcite CVE
adarshsanjeev Sep 19, 2022
0bafef3
Merge remote-tracking branch 'origin/master' into supress-calcite-cve
adarshsanjeev Sep 21, 2022
2707e64
Update comment
adarshsanjeev Sep 22, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions owasp-dependency-check-suppressions.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -632,4 +632,26 @@
<cve>CVE-2022-31197</cve>
</suppress>

<suppress>
<!-- avatica-server-1.17.0.jar -->
<notes><![CDATA[
file name: avatica-server-1.17.0.jar

@kfaraz kfaraz Sep 21, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The vulnerability is in calcite-core. Does it need to be suppressed for avatica-server too?

@adarshsanjeev adarshsanjeev Sep 21, 2022

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe calcite is used by avatica server too, wouldn't it need to be suppressed separately?

@kfaraz kfaraz Sep 21, 2022 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think so. Could you try running the security check without the extra suppression?

@abhishekagarwal87 abhishekagarwal87 Sep 23, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the failure is being reported for avatica-server as well.

[ERROR] ----------------------------------------------------
[ERROR] .NET Assembly Analyzer could not be initialized and at least one 'exe' or 'dll' was scanned. The 'dotnet' executable could not be found on the path; either disable the Assembly Analyzer or add the path to dotnet core in the configuration.
[ERROR] ----------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:7.0.4:aggregate (default-cli) on project druid: 
[ERROR] 
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0': 
[ERROR] 
[ERROR] avatica-server-1.17.0.jar: CVE-2022-39135(9.8)
[ERROR] calcite-core-1.21.0.jar: CVE-2022-39135(9.8)
[ERROR] 
[ERROR] See the dependency-check report for more details.
[ERROR] -> [Help 1]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException

]]></notes>
<!--
We do not expose any of the SQL operators that were found vulnerable in this CVE.
-->
<cve>CVE-2022-39135</cve>
</suppress>

<suppress>
<!-- calcite-core-1.21.0.jar -->
<notes><![CDATA[
file name: calcite-core-1.21.0.jar
]]></notes>
<!--
We do not expose any of the SQL operators that were found vulnerable in this CVE.
-->
<cve>CVE-2022-39135</cve>
</suppress>

</suppressions>