fix CVE-2025-48734 (opensearch-project#3986)

* fix CVE-2025-48734

Signed-off-by: Jing Zhang <[email protected]>

* fix building errors

Signed-off-by: Jing Zhang <[email protected]>

---------

Signed-off-by: Jing Zhang <[email protected]>

Author: jngz-es

ml-algorithms/build.gradle

@@ -28,10 +28,10 @@ dependencies {
     implementation ("org.jetbrains.kotlin:kotlin-stdlib:${kotlin_version}")
     implementation group: 'org.apache.commons', name: 'commons-text', version: '1.10.0'
     implementation group: 'org.reflections', name: 'reflections', version: '0.9.12'
-    implementation group: 'org.tribuo', name: 'tribuo-clustering-kmeans', version: '4.2.1'
-    implementation group: 'org.tribuo', name: 'tribuo-regression-sgd', version: '4.2.1'
-    implementation group: 'org.tribuo', name: 'tribuo-anomaly-libsvm', version: '4.2.1'
-    implementation group: 'org.tribuo', name: 'tribuo-classification-sgd', version: '4.2.1'
+    implementation group: 'org.tribuo', name: 'tribuo-clustering-kmeans', version: '4.3.2'
+    implementation group: 'org.tribuo', name: 'tribuo-regression-sgd', version: '4.3.2'
+    implementation group: 'org.tribuo', name: 'tribuo-anomaly-libsvm', version: '4.3.2'
+    implementation group: 'org.tribuo', name: 'tribuo-classification-sgd', version: '4.3.2'
     implementation group: 'commons-io', name: 'commons-io', version: '2.15.1'
     implementation 'software.amazon.randomcutforest:randomcutforest-parkservices:3.0-rc3'
     implementation 'software.amazon.randomcutforest:randomcutforest-core:3.0-rc3'
@@ -41,6 +41,7 @@ dependencies {
     implementation group: 'io.protostuff', name: 'protostuff-collectionschema', version: '1.8.0'
     testImplementation group: 'junit', name: 'junit', version: '4.13.2'
     testImplementation group: 'org.mockito', name: 'mockito-core', version: '5.7.0'
+    testImplementation group: 'org.apache.commons', name: 'commons-math3', version: '3.6.1'
     implementation (group: 'com.google.guava', name: 'guava', version: '32.1.3-jre') {
 	exclude group: 'com.google.errorprone', module: 'error_prone_annotations'
     }

ml-algorithms/src/test/java/org/opensearch/ml/engine/encryptor/EncryptorImplTest.java

@@ -583,7 +583,6 @@ public void encrypt_MasterKeyFieldMismatch_ShouldFallbackToProperKeyField() thro
         Encryptor encryptor = new EncryptorImpl(clusterService, client, sdkClient, mlIndicesHandler);
 
         // Old buggy code would try to access response.source().get(masterKeyId) and get null
-        // This test ensures the new fix works — we access MASTER_KEY properly
         String encrypted = encryptor.encrypt("test", TENANT_ID);
         Assert.assertNotNull(encrypted);
         Assert.assertEquals("test", encryptor.decrypt(encrypted, TENANT_ID));