Fix CVE-2022-34917 about kafka-client dependency

adkharat commented 1 week ago

Description

CVE-2022-34917 A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.

Motivation and Context

Impact

Test Plan

Contributor checklist

[ ] Please make sure your submission complies with our development, formatting, commit message, and attribution guidelines.
[ ] PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
[ ] Documented new properties (with its default value), SQL syntax, functions, or other functionality.
[ ] If release notes are required, they follow the release notes guidelines.
[ ] Adequate tests were added if applicable.
[ ] CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

Security Changes
* Upgrade kafka to 2.8.2 in response to `CVE-2022-34917 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34917>`_. :pr:`24097`

adkharat commented 1 week ago

@imjalpreet

I see unit test failures after upgrading Kafka from version 2.3.1 to 2.8.2. (Kafka 2.8.2 fixes CVE-2022-34917)

On log analysis, I see,

.github->workflows-> product-tests-basic-environment.yml -> executes presto-product-tests/bin/run_on_docker.sh -> executes presto-product-tests/conf/docker/files/run-tempto.sh

run-tempto.sh shell script is used to execute test cases using the TemptoProductTestRunner.java

Integration tests for "Presto" is dependent on tempto-kafka/tempto-runner from repo prestodb/tempto. Tempto dependency is using older versions:

kafka = 0.11.0.2
zkclient = 0.10

Questions:

1. Upgrade Tempto dependencies? Should I consider updating the Kafka and Zkclient versions within the [prestodb/tempto]. (https://github.com/prestodb/tempto/blob/master/build.gradle) repository? Are there any Tempto maintainers for [prestodb/tempto] as I don't see any activities on tempto repo in recent year.

2. Testing Tempto changes (if applicable) If upgrading Kafka and depricated function in tempto is necessary, how can I effectively test the modified tempto functionality without breaking UT functionality ?

mvn dependency:tree -Dverbose

[INFO] +- io.prestodb.tempto:tempto-kafka:jar:1.53:compile
[INFO] |  +- org.apache.kafka:kafka_2.12:jar:2.8.2:compile
[INFO] |  |  +- org.apache.kafka:kafka-metadata:jar:2.8.2:compile
[INFO] |  |  +- org.apache.kafka:kafka-raft:jar:2.8.2:compile
[INFO] |  |  +- net.sourceforge.argparse4j:argparse4j:jar:0.7.0:compile
[INFO] |  |  +- com.fasterxml.jackson.module:jackson-module-scala_2.12:jar:2.10.5:compile
[INFO] |  |  |  \- com.fasterxml.jackson.module:jackson-module-paranamer:jar:2.10.5:compile
[INFO] |  |  +- com.fasterxml.jackson.dataformat:jackson-dataformat-csv:jar:2.10.5:compile
[INFO] |  |  +- net.sf.jopt-simple:jopt-simple:jar:5.0.4:compile
[INFO] |  |  +- com.yammer.metrics:metrics-core:jar:2.2.0:compile
[INFO] |  |  +- org.scala-lang.modules:scala-collection-compat_2.12:jar:2.3.0:compile
[INFO] |  |  +- org.scala-lang.modules:scala-java8-compat_2.12:jar:0.9.1:compile
[INFO] |  |  +- org.scala-lang:scala-reflect:jar:2.12.13:compile
[INFO] |  |  \- com.typesafe.scala-logging:scala-logging_2.12:jar:3.9.2:compile
[INFO] |  \- com.101tec:zkclient:jar:0.10:compile
[INFO] |     \- org.apache.zookeeper:zookeeper:jar:3.4.14:compile
[INFO] |        +- com.github.spotbugs:spotbugs-annotations:jar:3.1.10:compile
[INFO] |        +- org.apache.yetus:audience-annotations:jar:0.5.0:compile
[INFO] |        \- io.netty:netty:jar:3.10.6.Final:compile

kafka.utils.ZkUtils was removed in Kafka - Version 2.4.0

2.0.0- > ZKUtils present
2.3.1 -> ZKUtils present
2.4.0 -> ZKUtils removed
2.8.2 -> ZKUtils not present

Reference link:

steveburnett commented 1 week ago

Thanks for the great release note! Just one nit suggestion about kafka as related to #18721.

== RELEASE NOTES ==

Security Changes
* Upgrade Apache Kafka to 2.8.2 in response to `CVE-2022-34917 <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34917>`_. :pr:`24097`

prestodb / presto