Skip to content

Commit 152b720

Browse files
xeniapexeniape
authored
fix(hive): Upgrade nimbus-jose-jwt in Hive to fix CVE-2025-53864 (#1249)
1 parent 8f93889 commit 152b720

6 files changed

+168
-0
lines changed

‎hive/stackable/patches/4.1.0/0001-Include-Postgres-driver.patch

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
From d6ef8813ba42cf47aefadc6068778f797ea00166 Mon Sep 17 00:00:00 2001
2+
From: xeniape <[email protected]>
3+
Date: Fri, 12 Sep 2025 17:25:00 +0200
4+
Subject: Include Postgres driver
5+
6+
---
7+
standalone-metastore/metastore-server/pom.xml | 1 -
8+
standalone-metastore/pom.xml | 1 -
9+
2 files changed, 2 deletions(-)
10+
11+
diff --git a/standalone-metastore/metastore-server/pom.xml b/standalone-metastore/metastore-server/pom.xml
12+
index 13f08ad92d..3f88c67e1c 100644
13+
--- a/standalone-metastore/metastore-server/pom.xml
14+
+++ b/standalone-metastore/metastore-server/pom.xml
15+
@@ -348,7 +348,6 @@
16+
<dependency>
17+
<groupId>org.postgresql</groupId>
18+
<artifactId>postgresql</artifactId>
19+
- <optional>true</optional>
20+
</dependency>
21+
<dependency>
22+
<groupId>org.eclipse.jetty</groupId>
23+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
24+
index da0612dcf9..4d1a08742a 100644
25+
--- a/standalone-metastore/pom.xml
26+
+++ b/standalone-metastore/pom.xml
27+
@@ -407,7 +407,6 @@
28+
<groupId>org.postgresql</groupId>
29+
<artifactId>postgresql</artifactId>
30+
<version>${postgres.version}</version>
31+
- <scope>runtime</scope>
32+
</dependency>
33+
<dependency>
34+
<groupId>org.apache.httpcomponents</groupId>

‎hive/stackable/patches/4.1.0/0002-Include-logging-dependencies.patch

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
From 56a982e562e33558b9cd20dd3afa9a57920a390d Mon Sep 17 00:00:00 2001
2+
From: xeniape <[email protected]>
3+
Date: Fri, 12 Sep 2025 17:25:42 +0200
4+
Subject: Include logging dependencies
5+
6+
---
7+
standalone-metastore/pom.xml | 5 +++++
8+
1 file changed, 5 insertions(+)
9+
10+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
11+
index 4d1a08742a..6b2bd5273a 100644
12+
--- a/standalone-metastore/pom.xml
13+
+++ b/standalone-metastore/pom.xml
14+
@@ -513,6 +513,11 @@
15+
<groupId>com.fasterxml.jackson.core</groupId>
16+
<artifactId>jackson-databind</artifactId>
17+
</dependency>
18+
+ <dependency>
19+
+ <!-- Optional log4j dependency to be able to use the XmlLayout -->
20+
+ <groupId>com.fasterxml.jackson.dataformat</groupId>
21+
+ <artifactId>jackson-dataformat-xml</artifactId>
22+
+ </dependency>
23+
</dependencies>
24+
<build>
25+
<pluginManagement>

‎hive/stackable/patches/4.1.0/0003-Add-CycloneDX-plugin.patch

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
From e41e6a49f3e27a785d80f0d9f446d97cf3aa59de Mon Sep 17 00:00:00 2001
2+
From: xeniape <[email protected]>
3+
Date: Fri, 12 Sep 2025 17:39:34 +0200
4+
Subject: Add CycloneDX plugin
5+
6+
---
7+
standalone-metastore/pom.xml | 18 ++++++++++++++++++
8+
1 file changed, 18 insertions(+)
9+
10+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
11+
index 6b2bd5273a..d976d51b48 100644
12+
--- a/standalone-metastore/pom.xml
13+
+++ b/standalone-metastore/pom.xml
14+
@@ -46,6 +46,7 @@
15+
<maven.cyclonedx.plugin.version>2.7.10</maven.cyclonedx.plugin.version>
16+
<maven.repo.local>${settings.localRepository}</maven.repo.local>
17+
<maven.exec.plugin.version>3.1.0</maven.exec.plugin.version>
18+
+ <maven.cyclonedx.plugin.version>2.8.0</maven.cyclonedx.plugin.version>
19+
<checkstyle.conf.dir>${basedir}/${standalone.metastore.path.to.root}/checkstyle</checkstyle.conf.dir>
20+
<!-- Test Properties -->
21+
<log4j.conf.dir>${project.basedir}/src/test/resources</log4j.conf.dir>
22+
@@ -592,6 +593,23 @@
23+
</excludes>
24+
</configuration>
25+
</plugin>
26+
+ <plugin>
27+
+ <groupId>org.cyclonedx</groupId>
28+
+ <artifactId>cyclonedx-maven-plugin</artifactId>
29+
+ <version>${maven.cyclonedx.plugin.version}</version>
30+
+ <configuration>
31+
+ <projectType>application</projectType>
32+
+ <schemaVersion>1.5</schemaVersion>
33+
+ </configuration>
34+
+ <executions>
35+
+ <execution>
36+
+ <phase>package</phase>
37+
+ <goals>
38+
+ <goal>makeBom</goal>
39+
+ </goals>
40+
+ </execution>
41+
+ </executions>
42+
+ </plugin>
43+
</plugins>
44+
</build>
45+
<profiles>

‎hive/stackable/patches/4.1.0/0004-Fix-CVE-2024-36114.patch

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
From 7784d902ad2d5a443119e0e6796995c3089c20ab Mon Sep 17 00:00:00 2001
2+
From: xeniape <[email protected]>
3+
Date: Fri, 12 Sep 2025 17:40:28 +0200
4+
Subject: Fix CVE-2024-36114
5+
6+
---
7+
standalone-metastore/pom.xml | 6 ++++++
8+
1 file changed, 6 insertions(+)
9+
10+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
11+
index d976d51b48..b5b06e3842 100644
12+
--- a/standalone-metastore/pom.xml
13+
+++ b/standalone-metastore/pom.xml
14+
@@ -131,6 +131,12 @@
15+
</properties>
16+
<dependencyManagement>
17+
<dependencies>
18+
+ <!-- Mitigate CVE-2024-36114: See https://github.com/stackabletech/vulnerabilities/issues/834 -->
19+
+ <dependency>
20+
+ <groupId>io.airlift</groupId>
21+
+ <artifactId>aircompressor</artifactId>
22+
+ <version>0.27</version>
23+
+ </dependency>
24+
<dependency>
25+
<groupId>org.apache.orc</groupId>
26+
<artifactId>orc-core</artifactId>

‎hive/stackable/patches/4.1.0/0005-Upgrade-nimbus-jose-jwt-to-9.37.4-to-fix-CVE-2025-53.patch

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
From f49ecc00f69c999b668d44b75cccd784860081a0 Mon Sep 17 00:00:00 2001
2+
From: xeniape <[email protected]>
3+
Date: Fri, 12 Sep 2025 17:43:16 +0200
4+
Subject: Upgrade-nimbus-jose-jwt-to-9.37.4-to-fix-CVE-2025-53864
5+
6+
---
7+
service/pom.xml | 2 +-
8+
standalone-metastore/pom.xml | 2 +-
9+
2 files changed, 2 insertions(+), 2 deletions(-)
10+
11+
diff --git a/service/pom.xml b/service/pom.xml
12+
index f002924b39..69dfc9aeb1 100644
13+
--- a/service/pom.xml
14+
+++ b/service/pom.xml
15+
@@ -25,7 +25,7 @@
16+
<name>Hive Service</name>
17+
<properties>
18+
<hive.path.to.root>..</hive.path.to.root>
19+
- <nimbus-jose-jwt.version>9.37.3</nimbus-jose-jwt.version>
20+
+ <nimbus-jose-jwt.version>9.37.4</nimbus-jose-jwt.version>
21+
</properties>
22+
<dependencies>
23+
<!-- dependencies are always listed in sorted order by groupId, artifactId -->
24+
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
25+
index b5b06e3842..ad295a2c40 100644
26+
--- a/standalone-metastore/pom.xml
27+
+++ b/standalone-metastore/pom.xml
28+
@@ -115,7 +115,7 @@
29+
<httpcomponents.core.version>4.4.13</httpcomponents.core.version>
30+
<httpcomponents.client.version>4.5.13</httpcomponents.client.version>
31+
<pac4j-core.version>4.5.8</pac4j-core.version>
32+
- <nimbus-jose-jwt.version>9.37.3</nimbus-jose-jwt.version>
33+
+ <nimbus-jose-jwt.version>9.37.4</nimbus-jose-jwt.version>
34+
<jetty.version>9.4.57.v20241219</jetty.version>
35+
<javax.annotation-api.version>1.3.2</javax.annotation-api.version>
36+
<!-- If upgrading, upgrade atlas as well in ql/pom.xml, which brings in some springframework dependencies transitively -->

‎hive/stackable/patches/4.1.0/patchable.toml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
mirror = "https://github.com/stackabletech/hive.git"
2+
base = "75e40b7537c91a70ccaa31c397d21823c7528eeb"

0 commit comments

Comments
 (0)