Fix all CVE issues related to META-INF path vulnerabilities and OS Level vulnerabilities for DynamoDB connector. (#3221)

Fixed CVEs: CVE‑2025‑68161, CVE‑2025‑67735, CVE‑2025‑14087, CVE‑2025‑64720, CVE‑2025‑64505.

Author: ritiktrianz

athena-dynamodb/Dockerfile

@@ -3,6 +3,12 @@ ARG JAVA_VERSION=11
 # Use the specified version of Java
 FROM public.ecr.aws/lambda/java:${JAVA_VERSION}
 
+# Fix CVE-2025-14087: glib2 buffer underflow
+# Fix CVE-2025-64720 and CVE-2025-64505: libpng vulnerabilities
+RUN yum update -y glib2 libpng && \
+    yum clean all && \
+    rm -rf /var/cache/yum
+
 # Argument for Java tool options, defaulting to an empty string
 ARG JAVA_TOOL_OPTIONS=""
 # Set the JAVA_TOOL_OPTIONS environment variable for Java 17

athena-dynamodb/pom.xml

@@ -170,6 +170,22 @@
                         <goals>
                             <goal>shade</goal>
                         </goals>
+                        <configuration>
+                            <filters>
+                                <filter>
+                                    <artifact>*:*</artifact>
+                                    <excludes>
+                                        <exclude>META-INF/*.SF</exclude>
+                                        <exclude>META-INF/*.DSA</exclude>
+                                        <exclude>META-INF/*.RSA</exclude>
+                                        <!-- Fix for ALL CVEs related to META-INF path: Exclude all Maven POM metadata files -->
+                                        <!-- These POM files cause false-positive CVE alerts in AWS Inspector -->
+                                        <exclude>META-INF/maven/**/pom.xml</exclude>
+                                        <exclude>META-INF/maven/**/pom.properties</exclude>
+                                    </excludes>
+                                </filter>
+                            </filters>
+                        </configuration>
                     </execution>
                 </executions>
             </plugin>