修复jackson-databind、gson、protobuf-java组件相关安全漏洞版本

Signed-off-by: lilai <lilai23@foxmail.com>
sermant-io · Nov 27, 2023 · 7db5ed2 · 7db5ed2
1 parent b3d1022
commit 7db5ed2
Show file tree

Hide file tree

Showing 15 changed files with 44 additions and 12 deletions.
diff --git a/pom.xml b/pom.xml
@@ -43,7 +43,7 @@
         <http.core.version>4.4.13</http.core.version>
         <Java-WebSocket.version>1.5.1</Java-WebSocket.version>
         <netty.version>4.1.94.Final</netty.version>
-        <protobuf.version>3.17.3</protobuf.version>
+        <protobuf.version>3.19.6</protobuf.version>
         <fastjson.version>1.2.83</fastjson.version>
         <xml.apis.version>1.4.01</xml.apis.version>
         <xerces.version>2.12.1</xerces.version>

diff --git a/sermant-agentcore/sermant-agentcore-implement/pom.xml b/sermant-agentcore/sermant-agentcore-implement/pom.xml
@@ -29,7 +29,7 @@
         <javadoc.plugin.version>3.3.2</javadoc.plugin.version>
         <nexus.staging.plugin.version>1.6.7</nexus.staging.plugin.version>
         <nacos.version>2.1.0</nacos.version>
-        <jackson-databind.version>2.13.4.1</jackson-databind.version>
+        <jackson-databind.version>2.13.4.2</jackson-databind.version>
     </properties>
 
     <dependencies>

diff --git a/sermant-backend/pom.xml b/sermant-backend/pom.xml
@@ -17,7 +17,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <io.netty.version>4.1.86.Final</io.netty.version>
         <spring-boot.version>2.6.1</spring-boot.version>
-        <protobuf-java.version>3.9.1</protobuf-java.version>
+        <protobuf-java.version>3.19.6</protobuf-java.version>
         <lombok.version>1.18.22</lombok.version>
         <fastjson.version>1.2.83</fastjson.version>
         <commons-lang.version>2.6</commons-lang.version>
@@ -29,7 +29,7 @@
         <jedis.version>4.3.1</jedis.version>
         <powermock.version>2.0.9</powermock.version>
         <expiringmap.version>0.5.8</expiringmap.version>
-        <jackson-databind.version>2.13.4.1</jackson-databind.version>
+        <jackson-databind.version>2.13.4.2</jackson-databind.version>
         <webapp.path>${project.basedir}/src/main/webapp/frontend</webapp.path>
     </properties>
 

diff --git a/sermant-injector/pom.xml b/sermant-injector/pom.xml
@@ -15,7 +15,7 @@
         <maven.compiler.source>8</maven.compiler.source>
         <maven.compiler.target>8</maven.compiler.target>
         <commons.io.version>2.11.0</commons.io.version>
-        <spring.boot.version>2.7.1</spring.boot.version>
+        <spring.boot.version>2.7.4</spring.boot.version>
     </properties>
 
     <dependencies>

diff --git a/sermant-integration-tests/dubbo-test/dubbo-2-7-integration-consumer/pom.xml b/sermant-integration-tests/dubbo-test/dubbo-2-7-integration-consumer/pom.xml
@@ -53,6 +53,10 @@
             <groupId>org.apache.dubbo</groupId>
             <artifactId>dubbo</artifactId>
         </dependency>
+        <dependency>
+            <groupId>com.google.code.gson</groupId>
+            <artifactId>gson</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.apache.curator</groupId>
             <artifactId>curator-framework</artifactId>

diff --git a/sermant-integration-tests/dubbo-test/dubbo-2-7-integration-controller/pom.xml b/sermant-integration-tests/dubbo-test/dubbo-2-7-integration-controller/pom.xml
@@ -38,6 +38,10 @@
             <groupId>org.apache.dubbo</groupId>
             <artifactId>dubbo</artifactId>
         </dependency>
+        <dependency>
+            <groupId>com.google.code.gson</groupId>
+            <artifactId>gson</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.apache.curator</groupId>
             <artifactId>curator-framework</artifactId>

diff --git a/sermant-integration-tests/dubbo-test/dubbo-2-7-integration-provider/pom.xml b/sermant-integration-tests/dubbo-test/dubbo-2-7-integration-provider/pom.xml
@@ -53,6 +53,10 @@
             <groupId>org.apache.dubbo</groupId>
             <artifactId>dubbo</artifactId>
         </dependency>
+        <dependency>
+            <groupId>com.google.code.gson</groupId>
+            <artifactId>gson</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.apache.curator</groupId>
             <artifactId>curator-framework</artifactId>

diff --git a/sermant-integration-tests/dubbo-test/pom.xml b/sermant-integration-tests/dubbo-test/pom.xml
@@ -67,6 +67,17 @@
                 <groupId>org.apache.dubbo</groupId>
                 <artifactId>dubbo</artifactId>
                 <version>${dubbo.version}</version>
+                <exclusions>
+                    <exclusion>
+                        <groupId>com.google.code.gson</groupId>
+                        <artifactId>gson</artifactId>
+                    </exclusion>
+                </exclusions>
+            </dependency>
+            <dependency>
+                <groupId>com.google.code.gson</groupId>
+                <artifactId>gson</artifactId>
+                <version>2.8.9</version>
             </dependency>
             <dependency>
                 <groupId>com.alibaba</groupId>

diff --git a/sermant-integration-tests/scripts/AgentLoader.java b/sermant-integration-tests/scripts/AgentLoader.java
@@ -14,8 +14,6 @@
  * limitations under the License.
  */
 
-package com.huaweicloud.sermant.script;
-
 import com.sun.tools.attach.AgentInitializationException;
 import com.sun.tools.attach.AgentLoadException;
 import com.sun.tools.attach.AttachNotSupportedException;

diff --git a/sermant-plugins/sermant-flowcontrol/flowcontrol-service/pom.xml b/sermant-plugins/sermant-flowcontrol/flowcontrol-service/pom.xml
@@ -37,7 +37,7 @@
         <package.plugin.type>service</package.plugin.type>
         <config.skip.flag>false</config.skip.flag>
         <resilience4j.version>1.7.1</resilience4j.version>
-        <jackson.version>2.13.4.1</jackson.version>
+        <jackson.version>2.13.4.2</jackson.version>
         <jackson.core.version>2.13.4</jackson.core.version>
     </properties>
 

diff --git a/sermant-plugins/sermant-service-registry/dubbo-registry-service/pom.xml b/sermant-plugins/sermant-service-registry/dubbo-registry-service/pom.xml
@@ -20,7 +20,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <dubbo.version>2.7.15</dubbo.version>
         <alibaba.dubbo.version>2.6.12</alibaba.dubbo.version>
-        <jackson.databind.version>2.13.4.1</jackson.databind.version>
+        <jackson.databind.version>2.13.4.2</jackson.databind.version>
         <surefire.plugin.version>2.22.2</surefire.plugin.version>
         <package.plugin.type>service</package.plugin.type>
         <config.skip.flag>false</config.skip.flag>

diff --git a/sermant-plugins/sermant-service-registry/spring-cloud-registry-plugin/pom.xml b/sermant-plugins/sermant-service-registry/spring-cloud-registry-plugin/pom.xml
@@ -71,6 +71,17 @@
             <artifactId>spring-cloud-starter-consul-discovery</artifactId>
             <version>${spring-cloud.version}</version>
             <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>com.google.code.gson</groupId>
+                    <artifactId>gson</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>com.google.code.gson</groupId>
+            <artifactId>gson</artifactId>
+            <version>2.8.9</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>

diff --git a/sermant-plugins/sermant-service-registry/spring-cloud-registry-service/pom.xml b/sermant-plugins/sermant-service-registry/spring-cloud-registry-service/pom.xml
@@ -17,7 +17,7 @@
         <ribbon-loadbalancer-version>2.3.0</ribbon-loadbalancer-version>
         <spring-cloud-version>2.1.0.RELEASE</spring-cloud-version>
         <slf4j.version>1.7.35</slf4j.version>
-        <jackson.databind.version>2.13.4.1</jackson.databind.version>
+        <jackson.databind.version>2.13.4.2</jackson.databind.version>
     </properties>
 
     <dependencies>

diff --git a/sermant-plugins/sermant-springboot-registry/springboot-registry-service/pom.xml b/sermant-plugins/sermant-springboot-registry/springboot-registry-service/pom.xml
@@ -19,7 +19,7 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <package.plugin.type>service</package.plugin.type>
         <cloud.zk.version>3.1.0</cloud.zk.version>
-        <jackson.version>2.13.4.1</jackson.version>
+        <jackson.version>2.13.4.2</jackson.version>
         <guava.version>31.1-jre</guava.version>
         <!--Curator 2.x.x兼容Zookeeper的3.4.x和3.5.x
             Curator 3.x.x只兼容Zookeeper 3.5.x-->

diff --git a/sermant-plugins/sermant-tag-transmission/tag-transmission-grpc-plugin/pom.xml b/sermant-plugins/sermant-tag-transmission/tag-transmission-grpc-plugin/pom.xml
@@ -17,7 +17,7 @@
         <config.skip.flag>false</config.skip.flag>
         <package.plugin.type>plugin</package.plugin.type>
         <grpc.version>1.52.1</grpc.version>
-        <protobuf.version>3.18.0</protobuf.version>
+        <protobuf.version>3.19.6</protobuf.version>
     </properties>
 
     <dependencies>