CVE Fixes by prasoon16081994 · Pull Request #77 · adobe/experience-platform-streaming-connect

prasoon16081994 · 2026-06-08T07:53:03Z

Library	From → To	Findings Cleared
commons-codec	1.11 → 1.18.0	1 (BDSA-2012-0001)
commons-lang3	3.9 → 3.18.0	1 (CVE-2025-48924)
jackson-core	2.14.0 → 2.21.3	4 (CVE-2025-52999, BDSA-2022-4307, BDSA-2025-5555, GHSA-72hv-8253-57qq)
jackson-databind	2.14.0 → 2.21.3	Keep aligned with jackson-core via jackson-bom
jackson-databind (CVE-2023-35116)	N/A	Suppress — disputed, no fix exists

garghima

Review — CVE Fixes

The remediation approach is solid — resolutionStrategy.force + jackson-bom is the right pattern for transitive-dep CVEs, and the PR description's CVE→version mapping table is excellent.

Two cleanups requested + one verification step. See inline comments. Quick summary:

ID	Severity	File	Issue
M1	Medium	`streaming-connect-{common,sink}/build.gradle`	`snakeyaml` and `commons-codec` declared as direct `implementation` deps despite zero direct usage in the codebase. `force` already covers the CVE.
M2	Medium	`build.gradle`	Comment references `CVE.md` which doesn't exist in the repo.
L1	Low	`.gitignore`	`.cursor/*` is editor-specific and unrelated to CVE work — recommend dropping or splitting.
L2	Low (nit)	`dependencies.gradle`	jackson-bom comment wording.
V1	Verify	`dependencies.gradle`	SnakeYAML 1.16 → 2.0 changes default `Yaml()` Constructor behavior. Run docker-compose smoke test.
V2	Verify	`dependencies.gradle`	Jackson 2.14 → 2.21 is a 7-minor jump. Codebase usage is conservative (no `enableDefaultTyping`, bare `ObjectMapper`), so `./gradlew test` passing is sufficient.

garghima

Follow-up review (after commit `8427cc4`)

Thanks for the quick turnaround. Status of the previous comments and a few new observations from the latest commit:

Status of v1 findings

ID	Status	Notes
M1 — `snakeyaml`/`commons-codec` as direct deps	✅ Resolved	Removed from both module `build.gradle` files and from `dependencies.gradle`.
M2 — comment referencing missing `CVE.md`	✅ Resolved	Comment dropped from `build.gradle`. (Optional: a committed `CVE.md` with the description's table is still nice-to-have so the traceability survives squash-merge.)
L1 — `.cursor/*` in `.gitignore`	❌ Open	Still on line 60. Not blocking.
L2 — jackson-bom comment wording	✅ N/A	Block was removed; pure resolution. (Minor regret — the comment was useful context; future readers will wonder why `libraries.jackson` lists bare GAVs. Replacing with a one-liner like `// jackson-bom resolves versions for all Jackson modules` would be ideal.)
V1 — SnakeYAML 2.0 breaking-change verification	✅ N/A (but see N1 below)	The `force 'org.yaml:snakeyaml:2.0'` was removed entirely.
V2 — Jackson 2.14 → 2.21 verification	🟡 Still applies	Version bump is still in place; `./gradlew test` + a smoke run should be sufficient.

New findings from this commit

ID	Severity	Where	Issue
N1	Medium	PR description / `build.gradle`	Snakeyaml dropped from the force list, but the PR description still claims `snakeyaml 1.16 → 2.0` remediates 8 CVEs. Either restore the pin or update the description so the audit trail matches reality.
N2	Low	`Dockerfile:13`	Base image tag is now floating (`eclipse-temurin:11-jre-alpine`) — same Dockerfile can produce different images on different days. Pin to a specific Temurin tag for reproducibility.
N3	Nit	`Dockerfile:64`	File lost its trailing newline.
+	Positive	`Dockerfile:26-29`	`curl -fsSLO` (fail-fast on HTTP errors) and explicit `gpg --batch --verify` are genuine security improvements over the previous version, which silently swallowed 404s and never verified signatures despite downloading them. Nicely done.

N1 — explanation

The PR description still has this row in the CVE table:

snakeyaml | 1.16 → 2.0 | 8 (all snakeyaml CVEs)

But the latest build.gradle no longer pins org.yaml:snakeyaml, so if snakeyaml is being pulled in transitively at the vulnerable version (kafka-connect-runtime pulls 1.x through its config-parsing path, and so does jjwt 0.9 in some configurations), those 8 CVEs are not being remediated by this PR.

Two paths forward:

Restore the force. Add force 'org.yaml:snakeyaml:2.0' back. The breaking-change risk I flagged in V1 (SnakeYAML 2.0 default Constructor restricts arbitrary deserialization) is real but verifiable — run ./gradlew clean build plus a docker-compose smoke run and watch for org.yaml.snakeyaml.constructor.ConstructorException in connector startup logs. If clean, ship with the force.
Drop snakeyaml from the description. If you've confirmed via ./gradlew dependencies that no transitive path actually brings in vulnerable snakeyaml (or that what's pulled in isn't reachable at runtime), update the PR description to remove the snakeyaml row and add a sentence explaining the omission. That way the audit trail in git log / PR history matches the code.

garghima · 2026-06-09T13:00:29Z

 ##

-FROM adoptopenjdk/openjdk11:jre-11.0.11_9-alpine
+FROM eclipse-temurin:11-jre-alpine


[N2] Floating image tag.

eclipse-temurin:11-jre-alpine is a rolling tag — each docker build pulls whatever the current LTS 11 JRE image is, which trades reproducibility for free patches.

For a release artifact (especially one bundled into a Kafka Connect distribution), reproducible builds usually win. Consider pinning to a specific Temurin tag, e.g.:

FROM eclipse-temurin:11.0.24_8-jre-alpine

The migration off adoptopenjdk itself is correct — that image is deprecated. This is just about the tag specificity.

garghima · 2026-06-09T13:00:29Z

+    curl -fsSLO "https://archive.apache.org/dist/kafka/${KAFKA_VERSION}/${KAFKA_DIST_TGZ}" && \
+    curl -fsSLO "https://archive.apache.org/dist/kafka/${KAFKA_VERSION}/${KAFKA_DIST_ASC}" && \
+    curl -fsSL  https://downloads.apache.org/kafka/KEYS | gpg -q --import - && \
+    gpg --batch --verify "${KAFKA_DIST_ASC}" "${KAFKA_DIST_TGZ}" && \


[Positive] Real security improvements here. Two things worth calling out:

curl -fsSLO now fails fast on HTTP errors. Previously, a 404 would silently save the HTML error page as kafka-2.8.0.tgz, and tar xfz later would either fail confusingly or — worse — succeed with junk. This is a genuine bug fix masquerading as a flag tweak.

The explicit gpg --batch --verify "${KAFKA_DIST_ASC}" "${KAFKA_DIST_TGZ}" step closes a real gap — the previous Dockerfile downloaded the signature and KEYS file but never actually called gpg --verify, so the chain of trust was theatre. Now it's real.

No action needed; just acknowledging.

garghima · 2026-06-09T13:00:29Z

 ENTRYPOINT ["/docker-entrypoint.sh"]

-CMD ["./start-connect.sh"]
+CMD ["./start-connect.sh"]


[N3 — nit] Missing trailing newline.

The \ No newline at end of file marker shows this file lost its trailing \n. POSIX text files should end with a newline; most tooling handles either form fine, but some shell-driven CI checks complain. Easy to fix: re-save with a trailing newline. Not blocking.

garghima

LGTM!

vivetiwa · 2026-06-10T02:43:23Z

+allprojects {
+  configurations.all {
+    resolutionStrategy {
+      force 'commons-codec:commons-codec:1.18.0'


Can we identify which other libraries are introducing older versions of these library?

vivetiwa · 2026-06-10T02:46:39Z

+      force 'commons-codec:commons-codec:1.18.0'
+      force 'org.apache.commons:commons-lang3:3.18.0'
+      force 'com.fasterxml.jackson.core:jackson-core:2.21.3'
+      force 'com.fasterxml.jackson.core:jackson-databind:2.21.3'


Versions can be referenced from dependencies.gradle, versions used across the project are controlled by this file.

vivetiwa · 2026-06-10T02:47:43Z

+
+allprojects {
+  configurations.all {
+    resolutionStrategy {


Can we not add resolutionStrategy to line 292 configurations.all block ?

vivetiwa · 2026-06-10T02:50:13Z

 ##

-FROM adoptopenjdk/openjdk11:jre-11.0.11_9-alpine
+FROM eclipse-temurin:11.0.31_11-jre-alpine


Just curious, is there issue with old jre version ?

vivetiwa · 2026-06-10T02:53:13Z

@prasoon16081994 Can you please add git issue to this fix and list of vulnerable libraries in the issue.

cve fix

2eb8e45

garghima reviewed Jun 8, 2026

View reviewed changes

change dockerfile and rmeove unused jars from imports

8427cc4

garghima reviewed Jun 9, 2026

View reviewed changes

fixes to dockerfile

60ab2b0

garghima approved these changes Jun 9, 2026

View reviewed changes

vivetiwa reviewed Jun 10, 2026

View reviewed changes

Conversation

prasoon16081994 commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

garghima left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Review — CVE Fixes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

garghima left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Follow-up review (after commit 8427cc4)

Status of v1 findings

New findings from this commit

N1 — explanation

Uh oh!

garghima Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

garghima Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

garghima Jun 9, 2026

Choose a reason for hiding this comment

Uh oh!

garghima left a comment

Choose a reason for hiding this comment

Uh oh!

vivetiwa Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

vivetiwa Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

vivetiwa Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

vivetiwa Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

vivetiwa commented Jun 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

prasoon16081994 commented Jun 8, 2026 •

edited

Loading

garghima left a comment •

edited

Loading

garghima left a comment •

edited

Loading

Follow-up review (after commit `8427cc4`)

garghima Jun 9, 2026 •

edited

Loading