Skip to content

Commit d933e1e

Browse files
NickLarsenNZNickLarsenNZ
authored
chore(hive): Bump dependencies ahead of 25.7.0 (#1100)
* chore(hive): Bump dependencies ahead of 25.7.0 * fix(java): Use vector 0.46.1 This was missed in #1098 * chore(hive): Patch postgres to resolve CVE-2024-1597 * chore(nix): Bump image-utils for newer bake Note: Should have been done as part of #1118 * chore(nix): Bump nixpkgs and install nodejs_20 to keep pre-commit happy I was getting the following error: ``` An unexpected error has occurred: CalledProcessError: command: ('/nix/store/15jzs4a11nqp4m1xvnw0rz9395anzjsm-nodejs-18.20.8/bin/node', '/run/current-system/sw/bin/npm', 'install', '--include=dev', '--include=prod', '--ignore-prepublish', '--no-progress', '--no-save') return code: 1 stdout: (none) stderr: npm error code EBADENGINE npm error engine Unsupported engine npm error engine Not compatible with your version of node/npm: markdownlint-cli@0.45.0 npm error notsup Not compatible with your version of node/npm: markdownlint-cli@0.45.0 npm error notsup Required: {"node":">=20"} npm error notsup Actual: {"npm":"10.8.2","node":"v18.20.8"} npm error A complete log of this run can be found in: /home/nick/.npm/_logs/2025-05-28T10_40_07_463Z-debug-0.log Check the log at /home/nick/.cache/pre-commit/pre-commit.log ``` * chore(hive): Revert hadoop and aws bumps, update changelog
1 parent 4494e39 commit d933e1e

File tree

6 files changed

+112
-9
lines changed

6 files changed

+112
-9
lines changed

‎CHANGELOG.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,8 @@ All notable changes to this project will be documented in this file.
8888
- zookeeper: reduce docker image size by removing the recursive chown/chmods in the final image ([#1043]).
8989
- Fixed two hardcoded username references ([#1052]).
9090
- ubi9-rust-builder: Use pinned `rustup` version ([#1121]).
91+
- hive: Patch for postgres CVE-2024-1597 ([#1100]).
92+
- bump image-tools (for `bake`) and nixpkgs (for `nodejs_20`, used by pre-commit) ([#1100]).
9193

9294
### Removed
9395

@@ -133,6 +135,7 @@ All notable changes to this project will be documented in this file.
133135
[#1097]: https://github.com/stackabletech/docker-images/pull/1097
134136
[#1098]: https://github.com/stackabletech/docker-images/pull/1098
135137
[#1099]: https://github.com/stackabletech/docker-images/pull/1099
138+
[#1100]: https://github.com/stackabletech/docker-images/pull/1100
136139
[#1101]: https://github.com/stackabletech/docker-images/pull/1101
137140
[#1102]: https://github.com/stackabletech/docker-images/pull/1102
138141
[#1103]: https://github.com/stackabletech/docker-images/pull/1103

‎hive/Dockerfile

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,10 @@ ln -s "/stackable/jmx/jmx_prometheus_javaagent-${JMX_EXPORTER}.jar" /stackable/j
7575

7676
# Add S3 Support for Hive (support for s3a://)
7777
cp /stackable/hadoop-${HADOOP}/share/hadoop/tools/lib/hadoop-aws-${HADOOP}.jar /stackable/apache-hive-metastore-${PRODUCT}-bin/lib/
78+
79+
# According to https://hadoop.apache.org/docs/stable/hadoop-aws/tools/hadoop-aws/aws_sdk_upgrade.html, the jar filename has changed from
80+
# aws-java-sdk-bundle-${AWS_JAVA_SDK_BUNDLE}.jar to bundle-${AWS_JAVA_SDK_BUNDLE}.jar. In future, you might need to do:
81+
# cp /stackable/hadoop-${HADOOP}/share/hadoop/tools/lib/bundle-${AWS_JAVA_SDK_BUNDLE}.jar /stackable/apache-hive-metastore-${PRODUCT}-bin/lib/
7882
cp /stackable/hadoop-${HADOOP}/share/hadoop/tools/lib/aws-java-sdk-bundle-${AWS_JAVA_SDK_BUNDLE}.jar /stackable/apache-hive-metastore-${PRODUCT}-bin/lib/
7983

8084
# Add Azure ABFS support (support for abfs://)

‎hive/stackable/patches/4.0.0/0005-Fix-CVE-2024-1597.patch

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
From 85fab788520b73e514e52e0753d36dafdf513e5b Mon Sep 17 00:00:00 2001
2+
From: Nick Larsen <nick.larsen@stackable.tech>
3+
Date: Thu, 15 May 2025 14:14:28 +0200
4+
Subject: Fix CVE-2024-1597
5+
6+
See https://github.com/stackabletech/vulnerabilities/issues/681
7+
8+
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using
9+
PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there
10+
is no vulnerability. A placeholder for a numeric value must be immediately
11+
preceded by a minus. There must be a second placeholder for a string value after
12+
the first placeholder; both must be on the same line. By constructing a matching
13+
string payload, the attacker can inject SQL to alter the query,bypassing the
14+
protections that parameterized queries bring against SQL Injection attacks.
15+
Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are
16+
affected.
17+
---
18+
pom.xml | 2 +-
19+
standalone-metastore/pom.xml | 2 +-
20+
2 files changed, 2 insertions(+), 2 deletions(-)
21+
22+
diff --git a/pom.xml b/pom.xml
23+
index a4dfc8d1e4..699228cba3 100644
24+
--- a/pom.xml
25+
+++ b/pom.xml
26+
@@ -178,7 +178,7 @@
27+
<mariadb.version>2.5.0</mariadb.version>
28+
<mssql.version>6.2.1.jre8</mssql.version>
29+
<mysql.version>8.0.31</mysql.version>
30+
- <postgres.version>42.5.1</postgres.version>
31+
+ <postgres.version>42.5.6</postgres.version>
32+
<oracle.version>21.3.0.0</oracle.version>
33+
<opencsv.version>2.3</opencsv.version>
34+
<orc.version>1.8.5</orc.version>
35+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
36+
index cd34884e3b..da84c8928e 100644
37+
--- a/standalone-metastore/pom.xml
38+
+++ b/standalone-metastore/pom.xml
39+
@@ -72,7 +72,7 @@
40+
<mariadb.version>2.5.0</mariadb.version>
41+
<mssql.version>6.2.1.jre8</mssql.version>
42+
<mysql.version>8.0.31</mysql.version>
43+
- <postgres.version>42.5.1</postgres.version>
44+
+ <postgres.version>42.5.6</postgres.version>
45+
<oracle.version>21.3.0.0</oracle.version>
46+
<dropwizard-metrics-hadoop-metrics2-reporter.version>0.1.2
47+
</dropwizard-metrics-hadoop-metrics2-reporter.version>

‎hive/stackable/patches/4.0.1/0005-Fix-CVE-2024-1597.patch

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
From 134b9e22475b3ae59eabbc0bf5c188912dc2393b Mon Sep 17 00:00:00 2001
2+
From: Nick Larsen <nick.larsen@stackable.tech>
3+
Date: Thu, 15 May 2025 14:14:28 +0200
4+
Subject: Fix CVE-2024-1597
5+
6+
See https://github.com/stackabletech/vulnerabilities/issues/681
7+
8+
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using
9+
PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there
10+
is no vulnerability. A placeholder for a numeric value must be immediately
11+
preceded by a minus. There must be a second placeholder for a string value after
12+
the first placeholder; both must be on the same line. By constructing a matching
13+
string payload, the attacker can inject SQL to alter the query,bypassing the
14+
protections that parameterized queries bring against SQL Injection attacks.
15+
Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are
16+
affected.
17+
---
18+
pom.xml | 2 +-
19+
standalone-metastore/pom.xml | 2 +-
20+
2 files changed, 2 insertions(+), 2 deletions(-)
21+
22+
diff --git a/pom.xml b/pom.xml
23+
index 1898adeebe..89cf93ed37 100644
24+
--- a/pom.xml
25+
+++ b/pom.xml
26+
@@ -179,7 +179,7 @@
27+
<mariadb.version>2.5.0</mariadb.version>
28+
<mssql.version>6.2.1.jre8</mssql.version>
29+
<mysql.version>8.0.31</mysql.version>
30+
- <postgres.version>42.5.1</postgres.version>
31+
+ <postgres.version>42.5.6</postgres.version>
32+
<oracle.version>21.3.0.0</oracle.version>
33+
<opencsv.version>2.3</opencsv.version>
34+
<orc.version>1.8.5</orc.version>
35+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
36+
index 599ad33ed0..17dfe063e8 100644
37+
--- a/standalone-metastore/pom.xml
38+
+++ b/standalone-metastore/pom.xml
39+
@@ -73,7 +73,7 @@
40+
<mariadb.version>2.5.0</mariadb.version>
41+
<mssql.version>6.2.1.jre8</mssql.version>
42+
<mysql.version>8.0.31</mysql.version>
43+
- <postgres.version>42.5.1</postgres.version>
44+
+ <postgres.version>42.5.6</postgres.version>
45+
<oracle.version>21.3.0.0</oracle.version>
46+
<dropwizard-metrics-hadoop-metrics2-reporter.version>0.1.2
47+
</dropwizard-metrics-hadoop-metrics2-reporter.version>

‎nix/sources.json

Lines changed: 6 additions & 6 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎shell.nix

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1-
{ sources ? import ./nix/sources.nix
2-
, nixpkgs ? sources.nixpkgs
3-
, pkgs ? import nixpkgs { }
1+
{
2+
sources ? import ./nix/sources.nix,
3+
nixpkgs ? sources.nixpkgs,
4+
pkgs ? import nixpkgs { },
45
}:
56

67
let
@@ -9,6 +10,7 @@ in
910
pkgs.mkShell {
1011
packages = [
1112
bake
13+
pkgs.nodejs_20
1214
];
1315

1416
buildInputs = [

0 commit comments

Comments
 (0)