Skip to content

Commit b953447

Browse files
SubhraBSubhraB
authored
Merge pull request #6 from Kong/fix/cve-updates-and-docker-improvements
fix: CVE updates and Docker improvements
2 parents 8c4e411 + deaf6e7 commit b953447

File tree

10 files changed

+400
-28
lines changed

10 files changed

+400
-28
lines changed

‎.github/dependabot.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,26 @@
55

66
version: 2
77
updates:
8+
# Keep GitHub Actions up to date
9+
- package-ecosystem: "github-actions"
10+
directory: "/"
11+
schedule:
12+
interval: "weekly"
13+
labels:
14+
- "dependencies"
15+
- "github-actions"
16+
commit-message:
17+
prefix: "chore"
18+
include: "scope"
19+
20+
# Keep Maven dependencies up to date
821
- package-ecosystem: "maven" # See documentation for possible values
922
directory: "/" # Location of package manifests
1023
schedule:
1124
interval: "weekly"
25+
labels:
26+
- "dependencies"
27+
- "maven"
28+
commit-message:
29+
prefix: "chore"
30+
include: "scope"

‎.github/workflows/kong-image-release.yaml‎

Lines changed: 53 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -9,24 +9,52 @@ env:
99
ECR_PROD_ROLE: arn:aws:iam::910202568813:role/ecr-github-kong-julie
1010

1111
jobs:
12-
release-details:
13-
name: Make Release Date
12+
determine-version:
13+
name: Determine Next Version
1414
runs-on: ubuntu-latest
1515
outputs:
16-
release_date: ${{ steps.date.outputs.release_date }}
16+
version: ${{ steps.bump.outputs.version }}
1717
steps:
18-
- name: Get current date
19-
id: date
20-
run: echo "::set-output name=release_date::$(date +'%Y-%m-%d-%H-%M')"
18+
- name: Checkout code
19+
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 #v4.2.1
20+
with:
21+
fetch-depth: 0 # Fetch all history for tags
22+
23+
- name: Get latest tag and bump version
24+
id: bump
25+
run: |
26+
# Get the latest tag that matches v*.*.* pattern
27+
LATEST_TAG=$(git tag -l "v*.*.*" | sort -V | tail -n 1)
28+
29+
if [ -z "$LATEST_TAG" ]; then
30+
# No tags found, start with v0.1.0
31+
NEW_VERSION="v0.1.0"
32+
echo "No existing tags found. Starting with $NEW_VERSION"
33+
else
34+
echo "Latest tag: $LATEST_TAG"
35+
# Remove 'v' prefix and split version
36+
VERSION_NO_V="${LATEST_TAG#v}"
37+
MAJOR=$(echo $VERSION_NO_V | cut -d. -f1)
38+
MINOR=$(echo $VERSION_NO_V | cut -d. -f2)
39+
PATCH=$(echo $VERSION_NO_V | cut -d. -f3)
40+
41+
# Increment patch version
42+
NEW_PATCH=$((PATCH + 1))
43+
NEW_VERSION="v${MAJOR}.${MINOR}.${NEW_PATCH}"
44+
echo "Bumping from $LATEST_TAG to $NEW_VERSION"
45+
fi
46+
47+
echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
48+
echo "Next version will be: $NEW_VERSION"
2149
2250
release-image:
2351
name: Release Image
2452
runs-on: ubuntu-latest
25-
needs: release-details
26-
if: ${{needs.release-details.result == 'success'}}
53+
needs: determine-version
54+
if: ${{needs.determine-version.result == 'success'}}
2755
environment: prod
2856
permissions:
29-
contents: read
57+
contents: write
3058
id-token: write
3159
steps:
3260
- name: Checkout code
@@ -35,22 +63,12 @@ jobs:
3563
- name: Set up the JDK
3664
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 #4.7.1
3765
with:
38-
java-version: 11
66+
java-version: 17
3967
distribution: temurin
4068
cache: maven
4169

4270
- name: Build with Maven
43-
run: mvn -B package --file pom.xml
44-
45-
- name: copy fat jar
46-
run: cp ./target/julie-ops.jar release/docker
47-
48-
- name: copy runner file
49-
run: cp ./src/main/scripts/julie-ops-cli.sh release/docker
50-
51-
- name: list files (release dir)
52-
run: ls -l
53-
working-directory: release/docker
71+
run: mvn -B package -DskipTests --file pom.xml
5472

5573
- name: Set up Docker Buildx
5674
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 #v3.10.0
@@ -65,12 +83,23 @@ jobs:
6583
- name: Login to ECR
6684
uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 #v2.0.1
6785
with:
68-
registry: ${{ env.ECR_ACCOUNT_ID }}
86+
registries: ${{ env.ECR_ACCOUNT_ID }}
6987

7088
- name: Build and push Docker image
7189
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 #v6.18.0
7290
with:
73-
context: release/docker
91+
context: .
7492
file: release/docker/Dockerfile
7593
push: true
76-
tags: ${{ env.ECR_PROD_REGISTRY }}:${{ needs.release-details.outputs.release_date }}
94+
build-args: |
95+
BASE_IMAGE_PREFIX=910202568813.dkr.ecr.us-east-2.amazonaws.com/dockerhub/library/
96+
tags: |
97+
${{ env.ECR_PROD_REGISTRY }}:${{ needs.determine-version.outputs.version }}
98+
${{ env.ECR_PROD_REGISTRY }}:latest
99+
100+
- name: Create Git tag
101+
run: |
102+
git config user.name "github-actions[bot]"
103+
git config user.email "github-actions[bot]@users.noreply.github.com"
104+
git tag -a ${{ needs.determine-version.outputs.version }} -m "Release ${{ needs.determine-version.outputs.version }}"
105+
git push origin ${{ needs.determine-version.outputs.version }}

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,4 @@ private.key
1515
rpm-gen-key
1616
.s3/
1717
.mvn
18+
.vscode/settings.json

‎DOCKER_COMPOSE_GUIDE.md‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
# Docker Compose Test Environment
2+
3+
This docker-compose setup creates a complete testing environment with:
4+
- **Kafka** (port 9092)
5+
- **Zookeeper** (port 2181)
6+
- **Kafbat UI** (port 8080)
7+
- **Julie-Ops** (Kafka Topology Builder)
8+
9+
## Quick Start
10+
11+
1. **Start all services:**
12+
```bash
13+
docker-compose up -d
14+
```
15+
16+
2. **Access Kafbat UI:**
17+
Open your browser to http://localhost:8080 to view and manage Kafka topics
18+
19+
3. **Run Julie-Ops commands:**
20+
```bash
21+
# Exec into the julie-ops container
22+
docker-compose exec julie-ops bash
23+
24+
# Example: Run topology builder with the example descriptor
25+
julie-ops-cli.sh \
26+
--brokers kafka:29092 \
27+
--clientConfig /config/topology-builder-docker.properties \
28+
--topology /config/descriptor-docker-test.yaml
29+
30+
# Or run directly without exec
31+
docker-compose exec julie-ops julie-ops-cli.sh \
32+
--brokers kafka:29092 \
33+
--clientConfig /config/topology-builder-docker.properties \
34+
--topology /config/descriptor-docker-test.yaml
35+
```
36+
37+
4. **View logs:**
38+
```bash
39+
# All services
40+
docker-compose logs -f
41+
42+
# Specific service
43+
docker-compose logs -f kafka
44+
docker-compose logs -f julie-ops
45+
```
46+
47+
5. **Stop all services:**
48+
```bash
49+
docker-compose down
50+
```
51+
52+
## Julie-Ops Configuration
53+
54+
The julie-ops container mounts two volumes:
55+
- `./example` → `/config` (contains properties and descriptor files)
56+
- `./topologies` → `/topologies` (for custom topology files)
57+
58+
### Example Usage
59+
60+
Create a simple topology descriptor in `example/descriptor-test.yaml`:
61+
62+
```yaml
63+
---
64+
context: "test"
65+
projects:
66+
- name: "myProject"
67+
topics:
68+
- name: "test.topic.a"
69+
config:
70+
replication.factor: "1"
71+
num.partitions: "3"
72+
- name: "test.topic.b"
73+
config:
74+
replication.factor: "1"
75+
num.partitions: "1"
76+
```
77+
78+
Then run:
79+
```bash
80+
docker-compose exec julie-ops julie-ops-cli.sh \
81+
--brokers kafka:29092 \
82+
--clientConfig /config/topology-builder-docker.properties \
83+
--topology /config/descriptor-test.yaml
84+
```
85+
86+
## Useful Commands
87+
88+
### Kafka Producer/Consumer Testing
89+
```bash
90+
# Produce messages
91+
docker-compose exec kafka kafka-console-producer \
92+
--bootstrap-server localhost:9092 \
93+
--topic test.topic.a
94+
95+
# Consume messages
96+
docker-compose exec kafka kafka-console-consumer \
97+
--bootstrap-server localhost:9092 \
98+
--topic test.topic.a \
99+
--from-beginning
100+
```
101+
102+
### List Topics
103+
```bash
104+
docker-compose exec kafka kafka-topics \
105+
--bootstrap-server localhost:9092 \
106+
--list
107+
```
108+
109+
## Troubleshooting
110+
111+
### Kafka not starting
112+
- Ensure ports 9092 and 2181 are not already in use
113+
- Check logs: `docker-compose logs kafka`
114+
115+
### Julie-Ops connection issues
116+
- Verify Kafka is running: `docker-compose ps`
117+
- Check bootstrap server in config files points to `kafka:29092` (internal) or `localhost:9092` (from host)
118+
119+
### Clean restart
120+
```bash
121+
# Stop and remove all containers and volumes
122+
docker-compose down -v
123+
124+
# Rebuild and start
125+
docker-compose up -d
126+
```
127+
128+
## Ports
129+
130+
- **9092** - Kafka (external access)
131+
- **29092** - Kafka (internal docker network)
132+
- **2181** - Zookeeper
133+
- **8080** - Kafbat UI
134+
135+
## Notes
136+
137+
- This is a **development/testing** setup with minimal configuration
138+
- No authentication/authorization configured
139+
- Single Kafka broker with replication factor 1
140+
- Data is ephemeral (removed with `docker-compose down -v`)

‎SECURITY.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Security Notice
2+
3+
## Fixed CVE Vulnerabilities
4+
5+
### ✅ CVE-2024-47561 - Apache Avro (CRITICAL) - FIXED
6+
- **Affected Version**: 1.11.3
7+
- **Fixed Version**: 1.11.4
8+
- **Issue**: Arbitrary Code Execution when reading Avro Data
9+
- **Status**: **RESOLVED** - Upgraded to avro 1.11.4
10+
11+
## Known CVE Vulnerabilities
12+
13+
### ⚠️ GHSA-72hv-8253-57qq - Jackson Core (HIGH) - NO FIX AVAILABLE YET
14+
- **Affected Versions**: All versions including 2.19.0
15+
- **Issue**: Number Length Constraint Bypass in Async Parser Leads to Potential DoS
16+
- **Status**: **MONITORING** - Using latest Jackson version (2.19.0), awaiting upstream fix
17+
18+
#### Description
19+
The non-blocking (async) JSON parser in jackson-core bypasses the maxNumberLength constraint (default: 1000 characters) defined in StreamReadConstraints. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion.
20+
21+
#### Impact
22+
- Memory Exhaustion: Unbounded allocation of memory in the TextBuffer
23+
- CPU Exhaustion: O(n²) BigInteger parsing operations
24+
25+
#### Mitigation Recommendations
26+
Until a patch is available:
27+
28+
1. **Configure StreamReadConstraints explicitly**:
29+
```java
30+
StreamReadConstraints constraints = StreamReadConstraints.builder()
31+
.maxNumberLength(1000) // Enforce limit explicitly
32+
.build();
33+
JsonFactory factory = JsonFactory.builder()
34+
.streamReadConstraints(constraints)
35+
.build();
36+
```
37+
38+
2. **Avoid async parsers** if possible - use synchronous parsers which correctly enforce the constraint
39+
40+
3. **Input validation** - Implement additional validation layers for JSON inputs from untrusted sources
41+
42+
4. **Rate limiting** - Implement rate limiting on endpoints that parse JSON
43+
44+
5. **Monitor** - Watch for updates to Jackson library: https://github.com/FasterXML/jackson-core
45+
46+
## Vulnerability Scanning
47+
48+
This project was scanned for CVEs on March 20, 2026. To re-scan dependencies:
49+
50+
```bash
51+
# Check for updates to dependencies with known CVEs
52+
mvn versions:display-dependency-updates
53+
54+
# Force update to latest versions (review carefully)
55+
mvn versions:use-latest-releases
56+
```
57+
58+
## Reporting Security Issues
59+
60+
If you discover a security vulnerability in this project, please report it privately by emailing the maintainers.

0 commit comments

Comments
 (0)