search

pentaho / pdi-sdk-plugins

PDI SDK plugins
111 stars 154 forks source link

[PDI-17667] Use of vulnerable component jetty 8.1.15, CVE-2017-9735, … #74

Closed smmribeiro closed 5 years ago

smmribeiro commented 5 years ago

…CVE-2017-7657 CVE-2015-2080

[PPP-4183] Use of Vulnerable Component: Multiple Jetty Components [Listed in Description] (CVE-2017-7656 | CVE-2017-7657 | CVE-2017-7658 | CVE-2015-2080 | CVE-2017-9735 )

With the differences between the currently used Jetty version and the new one, some transitive dependencies no longer appear; as so it was needed to declare them explicitly (note that they're all scope:test). Also updated .gitignore file.

Depends on pentaho/maven-parent-poms#121

@pentaho-lmartins @pentaho/tatooine @graimundo @nantunes

wingman-pentaho commented 5 years ago

Build Failed

:x: Something went wrong while validating this pull request.

Build Commands

mvn -B -f 'pom.xml' -pl 'kettle-sdk-embedding-samples,.' -P '!assemblies' -Dsurefire.runOrder=alphabetical -Daudit -amd clean install
Stdout log
(last 100 lines)
Retrieving source with org.pentaho.build.buddy.bundles.source.github.SlackbotGithubSourceRetriever@23672cb7
[INFO] Scanning for projects...
[INFO] Downloading from pentaho-public: http://nexus.pentaho.org/content/groups/omni/org/pentaho/pentaho-ce-jar-parent-pom/9.0.0.0-SNAPSHOT/maven-metadata.xml
[INFO] Downloaded from pentaho-public: http://nexus.pentaho.org/content/groups/omni/org/pentaho/pentaho-ce-jar-parent-pom/9.0.0.0-SNAPSHOT/maven-metadata.xml (836 B at 5.5 kB/s)
[INFO] Downloading from pentaho-public: http://nexus.pentaho.org/content/groups/omni/org/pentaho/pentaho-ce-parent-pom/9.0.0.0-SNAPSHOT/maven-metadata.xml
[INFO] Downloaded from pentaho-public: http://nexus.pentaho.org/content/groups/omni/org/pentaho/pentaho-ce-parent-pom/9.0.0.0-SNAPSHOT/maven-metadata.xml (832 B at 22 kB/s)
[INFO] Downloading from pentaho-public: http://nexus.pentaho.org/content/groups/omni/org/pentaho/pentaho-parent-pom/9.0.0.0-SNAPSHOT/maven-metadata.xml
[INFO] Downloaded from pentaho-public: http://nexus.pentaho.org/content/groups/omni/org/pentaho/pentaho-parent-pom/9.0.0.0-SNAPSHOT/maven-metadata.xml (612 B at 36 kB/s)
[ERROR] [ERROR] Some problems were encountered while processing the POMs:
[ERROR] 'dependencies.dependency.version' for org.eclipse.jetty:jetty-server:jar is missing. @ line 107, column 17
[ERROR] 'dependencies.dependency.version' for org.eclipse.jetty:jetty-servlet:jar is missing. @ line 112, column 17
 @ 
[ERROR] The build could not read 1 project -> [Help 1]
[ERROR]   
[ERROR]   The project pentaho-kettle:kettle-sdk-embedding-samples:9.0.0.0-SNAPSHOT (/home/buildguy/project/kettle-sdk-embedding-samples/pom.xml) has 2 errors
[ERROR]     'dependencies.dependency.version' for org.eclipse.jetty:jetty-server:jar is missing. @ line 107, column 17
[ERROR]     'dependencies.dependency.version' for org.eclipse.jetty:jetty-servlet:jar is missing. @ line 112, column 17
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/ProjectBuildingException
[INFO] Scanning for projects...
[INFO] Downloading from pentaho-public: http://nexus.pentaho.org/content/groups/omni/org/pentaho/pentaho-ce-jar-parent-pom/9.0.0.0-SNAPSHOT/maven-metadata.xml
[INFO] Downloaded from pentaho-public: http://nexus.pentaho.org/content/groups/omni/org/pentaho/pentaho-ce-jar-parent-pom/9.0.0.0-SNAPSHOT/maven-metadata.xml (836 B at 4.5 kB/s)
[INFO] Downloading from pentaho-public: http://nexus.pentaho.org/content/groups/omni/org/pentaho/pentaho-ce-parent-pom/9.0.0.0-SNAPSHOT/maven-metadata.xml
[INFO] Downloaded from pentaho-public: http://nexus.pentaho.org/content/groups/omni/org/pentaho/pentaho-ce-parent-pom/9.0.0.0-SNAPSHOT/maven-metadata.xml (832 B at 32 kB/s)
[INFO] Downloading from pentaho-public: http://nexus.pentaho.org/content/groups/omni/org/pentaho/pentaho-parent-pom/9.0.0.0-SNAPSHOT/maven-metadata.xml
[INFO] Downloaded from pentaho-public: http://nexus.pentaho.org/content/groups/omni/org/pentaho/pentaho-parent-pom/9.0.0.0-SNAPSHOT/maven-metadata.xml (612 B at 22 kB/s)
[ERROR] [ERROR] Some problems were encountered while processing the POMs:
[ERROR] 'dependencies.dependency.version' for org.eclipse.jetty:jetty-server:jar is missing. @ line 107, column 17
[ERROR] 'dependencies.dependency.version' for org.eclipse.jetty:jetty-servlet:jar is missing. @ line 112, column 17
 @ 
[ERROR] The build could not read 1 project -> [Help 1]
[ERROR]   
[ERROR]   The project pentaho-kettle:kettle-sdk-embedding-samples:9.0.0.0-SNAPSHOT (/home/buildguy/project/kettle-sdk-embedding-samples/pom.xml) has 2 errors
[ERROR]     'dependencies.dependency.version' for org.eclipse.jetty:jetty-server:jar is missing. @ line 107, column 17
[ERROR]     'dependencies.dependency.version' for org.eclipse.jetty:jetty-servlet:jar is missing. @ line 112, column 17
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/ProjectBuildingException

Stderr log

(last 100 lines)
java.lang.Exception: org.pentaho.build.buddy.bundles.orchestrator.OrchestratorImpl$BuildException: java.io.IOException: Head build returned with code 1
    at org.pentaho.build.buddy.bundles.orchestrator.OrchestratorImpl.orchestrate(OrchestratorImpl.java:381)
    at Proxy4950f66e_d83a_409d_a667_cdc6af9db6c1.orchestrate(Unknown Source)
    at org.pentaho.build.buddy.bundles.rest.OrchestratorRestService$1.write(OrchestratorRestService.java:62)
    at org.apache.cxf.jaxrs.provider.BinaryDataProvider.writeTo(BinaryDataProvider.java:172)
    at org.apache.cxf.jaxrs.utils.JAXRSUtils.writeMessageBody(JAXRSUtils.java:1381)
    at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.serializeMessage(JAXRSOutInterceptor.java:244)
    at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.processResponse(JAXRSOutInterceptor.java:120)
    at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.handleMessage(JAXRSOutInterceptor.java:83)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
    at org.apache.cxf.interceptor.OutgoingChainInterceptor.handleMessage(OutgoingChainInterceptor.java:83)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
    at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
    at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:253)
    at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:234)
    at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:208)
    at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:160)
    at org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:180)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:298)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:217)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
    at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:273)
    at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:812)
    at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:587)
    at org.ops4j.pax.web.service.jetty.internal.HttpServiceServletHandler.doHandle(HttpServiceServletHandler.java:71)
    at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
    at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:577)
    at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:223)
    at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1127)
    at org.ops4j.pax.web.service.jetty.internal.HttpServiceContext.doHandle(HttpServiceContext.java:287)
    at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515)
    at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)
    at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1061)
    at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
    at org.ops4j.pax.web.service.jetty.internal.JettyServerHandlerCollection.handle(JettyServerHandlerCollection.java:80)
    at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97)
    at org.eclipse.jetty.server.Server.handle(Server.java:499)
    at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:311)
    at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:257)
    at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:544)
    at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:635)
    at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:555)
    at java.lang.Thread.run(Thread.java:748)
Caused by: org.pentaho.build.buddy.bundles.orchestrator.OrchestratorImpl$BuildException: java.io.IOException: Head build returned with code 1
    at org.pentaho.build.buddy.bundles.orchestrator.OrchestratorImpl.doOrchestrate(OrchestratorImpl.java:609)
    at org.pentaho.build.buddy.bundles.orchestrator.OrchestratorImpl.orchestrate(OrchestratorImpl.java:364)
    ... 41 more
Caused by: java.io.IOException: Head build returned with code 1
    ... 43 more
smmribeiro commented 5 years ago

Closing PR: to simplify Karaf's upgrade a different approach was defined!