GH-44770: [Java] Update minor protobuf version to avoid CVE-2024-7254

apache / arrow

Apache Arrow is the universal columnar format and multi-language toolbox for fast data interchange and in-memory analytics

https://arrow.apache.org/

Apache License 2.0

14.63k stars 3.56k forks source link

GH-44770: [Java] Update minor protobuf version to avoid CVE-2024-7254 #44775

Closed raulcd closed 3 days ago

raulcd commented 3 days ago

Rationale for this change

There seems to be a CVE affecting our current dependency: https://github.com/advisories/GHSA-735f-pc8j-v9w8

What changes are included in this PR?

Update to latest minor which solves the issue.

Are these changes tested?

Via CI

Are there any user-facing changes?

GitHub Issue: #44770

github-actions[bot] commented 3 days ago

:warning: GitHub issue #44770 has been automatically assigned in GitHub to PR creator.

raulcd commented 3 days ago

@github-actions crossbow submit -g java

github-actions[bot] commented 3 days ago

Revision: ad603bc0a6eddf2e800d6974e73603ec8a3fabfb

Submitted crossbow builds: ursacomputing/crossbow @ actions-a223b3698c

Task	Status
java-jars
test-conda-python-3.11-spark-master
verify-rc-source-java-linux-almalinux-8-amd64
verify-rc-source-java-linux-conda-latest-amd64
verify-rc-source-java-linux-ubuntu-20.04-amd64
verify-rc-source-java-linux-ubuntu-22.04-amd64
verify-rc-source-java-macos-amd64

raulcd commented 3 days ago

Not related with this PR but I saw we seem to be using a pretty old bundled version on C++, see:

https://github.com/apache/arrow/blob/00de992cf954884644692b27a983e3ac9040ef86/cpp/thirdparty/versions.txt#L95-L96

What is our policy for updating those dependencies? Do we have any? Should we update it? cc @kou

lidavidm commented 3 days ago

We can update the bundled version.

kou commented 3 days ago

We don't have our update policy. But we should keep updating dependencies as much as possible for performance and security.

conbench-apache-arrow[bot] commented 2 days ago

After merging your PR, Conbench analyzed the 3 benchmarking runs that have been run so far on merge-commit ea8b1d3c7666d37a2dc8b7979f88879e033f4c28.

There were no benchmark performance regressions. 🎉

The full Conbench report has more details. It also includes information about 23 possible false positives for unstable benchmarks that are known to sometimes produce them.