jayakasadev opened a new pull request, #68352:
URL: https://github.com/apache/doris/pull/68352
### What problem does this PR solve?
Issue Number: close #xxx
Related PR: #68351 (stacked on top of it; this branch contains that commit)
Problem Summary:
`trivy image` on the published runtime images reports CRITICAL findings for
two
FE dependencies. Scanning apache/doris:fe-4.1.4, be-4.1.4 and ms-4.1.4 shows
`netty-handler` and `bcprov-jdk18on` in every one of them, and the versions
on
master are still affected:
Netty 4.2.15.Final -> 4.2.17.Final fixes two flaws in how the default SNI
path
handles fragmented TLS ClientHello records:
- CVE-2026-75595 (CRITICAL): SNI routing bypass. A ClientHello split across
TLS
records makes SNI extraction fail, so the connection silently falls back
to the
default `SslContext` instead of the virtual host's, i.e. it can be served
with
the wrong certificate/trust configuration.
- CVE-2026-75596: quadratic pre-handshake reassembly in the same parsing
path,
a pre-auth CPU DoS.
Both sit in `netty-handler`, which backs the FE's TLS-terminating listeners
(HTTP/8030 and Arrow Flight SQL), so they are reachable before
authentication.
Bouncy Castle 1.84 -> 1.85 fixes two flaws that the existing 1.84 pin (added
for
CVE-2025-14813 and friends) does not cover:
- CVE-2026-8763 (CRITICAL): Name Constraints bypass via a trailing dot in
`rfc822Name` and URI name forms, i.e. a certificate can escape the
constraints
an issuer set on it.
- CVE-2026-13506: forcing a lazily-parsed ASN.1 sequence resets the
nesting-depth guard, defeating the recursion limit on untrusted DER.
Doris reaches Bouncy Castle through the Huawei OBS/IAM SDK in
`fe-filesystem-obs`, which is on the certificate-validation path for that
filesystem, so both are relevant.
Confirmed against OSV that 4.2.17.Final and 1.85 carry no known advisories,
while 4.2.15.Final has 2 and 1.84 has 2.
Both are patch-level upgrades within the line already in use:
- The Netty version flows through the `netty-bom` import in `fe/pom.xml`, so
one
property moves the whole aligned graph. `regression-test/framework/pom.xml`
hardcodes `netty-all` instead of using the property, so it is bumped in
step
and a comment now records that coupling.
- Arrow 19.0.0 (`arrow.version`) declares `dep.netty-bom.version`
4.2.9.Final and
takes its Netty deps unversioned from the BOM, so the FE override
continues to
apply; master was already 6 patch releases ahead at 4.2.15.Final. Verified
the
`netty-buffer` class surface Arrow allocates against is unchanged between
4.2.15.Final and 4.2.17.Final.
- Bouncy Castle point releases are API-stable and the pin is a managed
override,
so the OBS SDK keeps resolving against it.
### Release note
Upgraded Netty to 4.2.17.Final (fixes CVE-2026-75595 SNI routing bypass and
CVE-2026-75596 pre-handshake DoS, both reachable pre-authentication on the
FE's
TLS ports) and Bouncy Castle to 1.85 (fixes CVE-2026-8763 Name Constraints
bypass
and CVE-2026-13506 ASN.1 nesting-depth guard reset).
### Check List (For Author)
- Test: Manual test - verified every bumped coordinate resolves from Maven
Central, cross-checked the before/after advisory sets against OSV, and
diffed
the netty-buffer class surface Arrow depends on to confirm the patch bump
is
API-compatible. A local FE build was not possible in this environment
because
`thirdparty/installed/bin/protoc` is absent, so CI is relied on for
compile and
FE unit tests; these are version-only changes with no code touched.
- Behavior changed: No
- Does this need documentation: No
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
