TEZ-4422 : [CVE-2021-43138] Upgrade async from 2.3.0 to 2.6.4 #217

amanraj2520 · 2022-06-07T07:15:01Z

Upgrade async from 2.3.0 to 2.6.4 to fix the vulnerability. Also an upgrade of yarn version to 1.6.0 and frontend maven plugin to 1.8.0 was done along with this change. Link to JIRA : https://issues.apache.org/jira/browse/TEZ-4422

Link to parent JIRA : https://issues.apache.org/jira/browse/TEZ-4419

RFC documentation : https://github.com/yarnpkg/rfcs/blob/master/implemented/0000-selective-versions-resolutions.md

…the vulnerability. Also an upgrade of yarn version to 1.6.0 and frontend maven plugin to 1.8.0 was done.

amanraj2520 · 2022-06-07T07:16:45Z

@abstractdog Can you please review this PR. As suggested by you, I am raising individual PR's for the TEZ-4419 parent issue.

tez-yetus · 2022-06-07T09:32:54Z

💔 -1 overall

Vote	Subsystem	Runtime	Comment
+0 🆗	reexec	13m 49s	Docker mode activated.
		_ Prechecks _
+1 💚	dupname	0m 0s	No case conflicting files found.
+1 💚	@author	0m 0s	The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s	The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
		_ master Compile Tests _
+0 🆗	mvndep	6m 49s	Maven dependency ordering for branch
+1 💚	mvninstall	11m 8s	master passed
+1 💚	compile	3m 44s	master passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚	compile	3m 21s	master passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚	javadoc	2m 52s	master passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚	javadoc	2m 13s	master passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
		_ Patch Compile Tests _
+0 🆗	mvndep	0m 17s	Maven dependency ordering for patch
+1 💚	mvninstall	6m 33s	the patch passed
+1 💚	compile	3m 34s	the patch passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚	javac	3m 34s	the patch passed
+1 💚	compile	3m 19s	the patch passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
+1 💚	javac	3m 19s	the patch passed
+1 💚	whitespace	0m 0s	The patch has no whitespace issues.
+1 💚	xml	0m 3s	The patch has no ill-formed XML file.
+1 💚	javadoc	2m 38s	the patch passed with JDK Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1
+1 💚	javadoc	2m 11s	the patch passed with JDK Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
		_ Other Tests _
+1 💚	unit	2m 17s	tez-ui in the patch passed.
+1 💚	unit	70m 6s	root in the patch passed.
+1 💚	asflicense	1m 9s	The patch does not generate ASF License warnings.
		137m 18s

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-217/1/artifact/out/Dockerfile
GITHUB PR	#217
Optional Tests	dupname asflicense javac javadoc unit xml compile
uname	Linux 95e936e1f84c 4.15.0-169-generic #177-Ubuntu SMP Thu Feb 3 10:50:38 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	personality/tez.sh
git revision	master / `e5a5578`
Default Java	Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Private Build-11.0.15+10-Ubuntu-0ubuntu0.20.04.1 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_312-8u312-b07-0ubuntu1~20.04-b07
Test Results	https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-217/1/testReport/
Max. process+thread count	1484 (vs. ulimit of 5500)
modules	C: tez-ui . U: .
Console output	https://ci-hadoop.apache.org/job/tez-multibranch/job/PR-217/1/console
versions	git=2.25.1 maven=3.6.3
Powered by	Apache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

abstractdog · 2022-06-08T07:07:27Z

pom.xml

@@ -67,7 +67,7 @@
    <roaringbitmap.version>0.7.45</roaringbitmap.version>
    <protoc.path>${env.PROTOC_PATH}</protoc.path>
    <scm.url>scm:git:https://gitbox.apache.org/repos/asf/tez.git</scm.url>
-    <frontend-maven-plugin.version>1.4</frontend-maven-plugin.version>
+    <frontend-maven-plugin.version>1.8.0</frontend-maven-plugin.version>


is this related to async upgrade?

please confirm this one

@abstractdog I confirm this change

abstractdog · 2022-06-08T07:07:32Z

tez-ui/pom.xml

@@ -374,7 +374,7 @@
            </goals>
            <configuration>
              <nodeVersion>${nodeVersion}</nodeVersion>
-              <yarnVersion>v0.21.3</yarnVersion>
+              <yarnVersion>v1.6.0</yarnVersion>


is this related to async upgrade?

please confirm this one

@abstractdog I confirm this change

I mean, this looks like a major version change of yarn, can you please let me know how is this related to the CVE patch (or is it necessary)?
I prefer doing version changes in separate patches if they're not closely related

@abstractdog The yarnVersion was changed since the selective dependency feature is only supported in yarn 1.0 and above. And yarnVersion of 1.6.0 is compatible with frontend maven plugin 1.8.0. That's why I did this change.

cool, thanks for clarifying @amanraj2520 !

abstractdog · 2022-06-08T07:07:43Z

tez-ui/src/main/webapp/yarn.lock

-lodash@^4.14.0:
-  version "4.17.4"
-  resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.4.tgz#78203a4d1c328ae1d86dca6460e369b57f4055ae"
+lodash@^4.17.14:


is this related to async upgrade?

@abstractdog Yes these are related to async upgrade. The yark.lock file is automatically updated based on package.json.

abstractdog · 2022-06-08T07:09:11Z

left minor comments
I'm fine with upgrading single dependencies separately until Ember3 upgrade is not finished (it looks like a huge PR) if they don't clash with each other

amanraj2520 · 2022-06-08T07:11:56Z

@abstractdog @guptanikhil007 Should we first merge the Ember3 upgrade or push these vulnerability fixes first?

abstractdog · 2022-06-13T06:26:02Z

I don't think it's a problem to merge these version bumps first, and then do Ember3 update later when @jteagles has the bandwidth for it, please let me know @jteagles if have any objections with this

amanraj2520 · 2022-06-13T06:45:35Z

Yes I think we are good with these changes from our side. I have run tests locally as well with this PR. According to me we can go ahead with this merge @abstractdog

abstractdog

+1 LGTM

I'm merging in 12 hours if there are no further comments

amanraj2520 · 2022-06-14T08:25:55Z

@abstractdog Can we please merge this PR. I will raise PR's for remaining vulnerabilities as well after this.

amanraj2520 · 2022-06-15T09:13:20Z

@abstractdog Just a gentle reminder, can you please merge this PR

abstractdog · 2022-06-15T09:25:51Z

merged, sorry for the delay!

[TEZ-4422] [CVE-2021-43138] Upgrade async from 2.3.0 to 2.6.4 to fix …

a5e60b5

…the vulnerability. Also an upgrade of yarn version to 1.6.0 and frontend maven plugin to 1.8.0 was done.

guptanikhil007 approved these changes Jun 7, 2022

View reviewed changes

abstractdog reviewed Jun 8, 2022

View reviewed changes

abstractdog self-requested a review June 13, 2022 09:37

abstractdog approved these changes Jun 13, 2022

View reviewed changes

abstractdog merged commit 3da8438 into apache:master Jun 15, 2022

tez-yetus mentioned this pull request Mar 14, 2023

TEZ-4463: Upgrade jquery-ui to 1.13.2 due to CVE issues #259

Closed

tez-yetus mentioned this pull request Apr 10, 2023

TEZ-4487: Add class name profiling option in ProfileServlet #281

Merged

This was referenced Apr 27, 2023

TEZ-4492 : Approach 2 : Disable strict-ssl for Bower and Yarn Registry to avoid Registry CERT_EXPIRE issue #283

Closed

TEZ-4492 : Approach 1 : Update Bower Registry to a different mirror #284

Merged

tez-yetus mentioned this pull request May 3, 2023

TEZ-4493: Upgrade Hadoop to 3.3.6 #285

Merged

This was referenced Jun 21, 2023

TEZ-4250: Optimise TaskImpl::getCounters. #295

Merged

TEZ-4407: Misleading split info in TezSplitGrouper logs when adjusting small splits #202

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

TEZ-4422 : [CVE-2021-43138] Upgrade async from 2.3.0 to 2.6.4 #217

TEZ-4422 : [CVE-2021-43138] Upgrade async from 2.3.0 to 2.6.4 #217

amanraj2520 commented Jun 7, 2022 •

edited

Loading

amanraj2520 commented Jun 7, 2022

tez-yetus commented Jun 7, 2022

abstractdog Jun 8, 2022

abstractdog Jun 13, 2022

amanraj2520 Jun 13, 2022

abstractdog Jun 8, 2022

abstractdog Jun 13, 2022

amanraj2520 Jun 13, 2022

abstractdog Jun 13, 2022

amanraj2520 Jun 13, 2022

abstractdog Jun 13, 2022

abstractdog Jun 8, 2022

amanraj2520 Jun 8, 2022

abstractdog commented Jun 8, 2022

amanraj2520 commented Jun 8, 2022

abstractdog commented Jun 13, 2022

amanraj2520 commented Jun 13, 2022

abstractdog left a comment

amanraj2520 commented Jun 14, 2022

amanraj2520 commented Jun 15, 2022

abstractdog commented Jun 15, 2022

TEZ-4422 : [CVE-2021-43138] Upgrade async from 2.3.0 to 2.6.4 #217

TEZ-4422 : [CVE-2021-43138] Upgrade async from 2.3.0 to 2.6.4 #217

Conversation

amanraj2520 commented Jun 7, 2022 • edited Loading

amanraj2520 commented Jun 7, 2022

tez-yetus commented Jun 7, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

abstractdog commented Jun 8, 2022

amanraj2520 commented Jun 8, 2022

abstractdog commented Jun 13, 2022

amanraj2520 commented Jun 13, 2022

abstractdog left a comment

Choose a reason for hiding this comment

amanraj2520 commented Jun 14, 2022

amanraj2520 commented Jun 15, 2022

abstractdog commented Jun 15, 2022

amanraj2520 commented Jun 7, 2022 •

edited

Loading