Skip to content
This repository was archived by the owner on Apr 22, 2025. It is now read-only.

Commit 0e9ef92

Browse files
bestbeforetodaybestbeforetoday
authored
Update dependencies to address CVE-2022-45688, CVE-2022-1471 (#283)
Signed-off-by: Mark S. Lewis <[email protected]>
1 parent f566012 commit 0e9ef92

File tree

6 files changed

+49
-46
lines changed

6 files changed

+49
-46
lines changed

‎dependency-suppressions.xml‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,3 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3-
<suppress>
4-
<notes><![CDATA[
5-
CVE was reported against @grpc/grpc-js npm package, not Java
6-
]]></notes>
7-
<packageUrl regex="true">^pkg:maven/io\.opentelemetry\.instrumentation/opentelemetry\-grpc\-1\.6@.*$</packageUrl>
8-
<cve>CVE-2020-7768</cve>
9-
</suppress>
10-
<suppress>
11-
<notes><![CDATA[
12-
CVE was reported in version 1.4-M1 to 1.4-RC and fixed in version 1.4.0
13-
]]></notes>
14-
<packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin\-stdlib\-common@1\.4\.0$</packageUrl>
15-
<cve>CVE-2020-15824</cve>
16-
</suppress>
17-
<suppress>
18-
<notes><![CDATA[
19-
Vulnerability is reported against an AWS hotfix, not the Apache log4j package
20-
]]></notes>
21-
<packageUrl regex="true">^pkg:maven/org\.apache\.logging\.log4j/log4j\-.*$</packageUrl>
22-
<cve>CVE-2022-33915</cve>
23-
</suppress>
243
</suppressions>

‎pom.xml‎

Lines changed: 39 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -28,16 +28,15 @@
2828
<url>http://github.com/hyperledger/fabric-sdk-java</url>
2929
</scm>
3030
<properties>
31-
<grpc.version>1.54.1</grpc.version>
32-
<protobuf.version>3.21.12</protobuf.version> <!-- Must match version used by grpc-protobuf -->
33-
<bouncycastle.version>1.73</bouncycastle.version>
31+
<grpc.version>1.56.0</grpc.version>
32+
<protobuf.version>3.22.5</protobuf.version> <!-- Must match version used by grpc-protobuf -->
33+
<bouncycastle.version>1.74</bouncycastle.version>
3434
<httpclient.version>4.5.14</httpclient.version>
35-
<javadoc.version>3.2.0</javadoc.version>
35+
<javadoc.version>3.4.1</javadoc.version>
3636
<skipITs>true</skipITs>
37-
<alpn-boot-version>8.1.7.v20160121</alpn-boot-version>
3837
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
39-
<jacoco.version>0.8.8</jacoco.version>
40-
<log4j.version>2.19.0</log4j.version>
38+
<jacoco.version>0.8.10</jacoco.version>
39+
<log4j.version>2.20.0</log4j.version>
4140
<org.hyperledger.fabric.sdktest.ITSuite>IntegrationSuite.java</org.hyperledger.fabric.sdktest.ITSuite>
4241
<gpg.executable>gpg</gpg.executable>
4342
</properties>
@@ -47,7 +46,7 @@
4746
<plugin>
4847
<groupId>org.apache.maven.plugins</groupId>
4948
<artifactId>maven-checkstyle-plugin</artifactId>
50-
<version>2.17</version>
49+
<version>3.0.0</version>
5150
<reportSets>
5251
<reportSet>
5352
<reports>
@@ -81,14 +80,14 @@
8180
<dependency>
8281
<groupId>io.opentelemetry</groupId>
8382
<artifactId>opentelemetry-bom</artifactId>
84-
<version>1.23.1</version>
83+
<version>1.27.0</version>
8584
<type>pom</type>
8685
<scope>import</scope>
8786
</dependency>
8887
<dependency>
8988
<groupId>io.opentelemetry.instrumentation</groupId>
9089
<artifactId>opentelemetry-instrumentation-bom-alpha</artifactId>
91-
<version>1.23.0-alpha</version>
90+
<version>1.27.0-alpha</version>
9291
<type>pom</type>
9392
<scope>import</scope>
9493
</dependency>
@@ -154,12 +153,12 @@
154153
<dependency>
155154
<groupId>org.apache.commons</groupId>
156155
<artifactId>commons-compress</artifactId>
157-
<version>1.22</version>
156+
<version>1.23.0</version>
158157
</dependency>
159158
<dependency>
160159
<groupId>commons-io</groupId>
161160
<artifactId>commons-io</artifactId>
162-
<version>2.11.0</version>
161+
<version>2.13.0</version>
163162
</dependency>
164163

165164
<!-- https://mvnrepository.com/artifact/org.apache.logging.log4j/log4j-core -->
@@ -200,7 +199,7 @@
200199
<dependency>
201200
<groupId>com.google.api</groupId>
202201
<artifactId>api-common</artifactId>
203-
<version>2.6.1</version>
202+
<version>2.12.0</version>
204203
</dependency>
205204

206205
<!-- https://mvnrepository.com/artifact/org.glassfish/javax.json -->
@@ -214,7 +213,7 @@
214213
<dependency>
215214
<groupId>org.yaml</groupId>
216215
<artifactId>snakeyaml</artifactId>
217-
<version>1.33</version>
216+
<version>2.0</version>
218217
</dependency>
219218

220219
<!-- https://mvnrepository.com/artifact/org.miracl.milagro.amcl/milagro-crypto-java -->
@@ -298,7 +297,7 @@
298297
<plugin>
299298
<groupId>org.apache.maven.plugins</groupId>
300299
<artifactId>maven-surefire-plugin</artifactId>
301-
<version>3.0.0-M5</version>
300+
<version>3.0.0-M7</version>
302301
<configuration>
303302
<argLine>${surefireArgLine}</argLine>
304303
<includes>
@@ -310,7 +309,7 @@
310309
<plugin>
311310
<groupId>org.apache.maven.plugins</groupId>
312311
<artifactId>maven-failsafe-plugin</artifactId>
313-
<version>3.0.0-M5</version>
312+
<version>3.1.2</version>
314313
<configuration>
315314
<argLine>${failsafeArgLine}</argLine>
316315
<includes>
@@ -357,7 +356,7 @@
357356
<plugin>
358357
<groupId>org.apache.maven.plugins</groupId>
359358
<artifactId>maven-compiler-plugin</artifactId>
360-
<version>3.8.1</version>
359+
<version>3.10.1</version>
361360
<configuration>
362361
<source>1.8</source>
363362
<target>1.8</target>
@@ -609,7 +608,7 @@
609608
<plugin>
610609
<groupId>pl.project13.maven</groupId>
611610
<artifactId>git-commit-id-plugin</artifactId>
612-
<version>2.2.6</version>
611+
<version>4.9.10</version>
613612
<executions>
614613
<execution>
615614
<id>get-the-git-infos</id>
@@ -626,7 +625,7 @@
626625
<plugin>
627626
<groupId>org.apache.maven.plugins</groupId>
628627
<artifactId>maven-jar-plugin</artifactId>
629-
<version>3.2.0</version>
628+
<version>3.3.0</version>
630629
<configuration>
631630
<archive>
632631
<manifestEntries>
@@ -651,6 +650,26 @@
651650
</execution>
652651
</executions>
653652
</plugin>
653+
<plugin>
654+
<groupId>org.apache.maven.plugins</groupId>
655+
<artifactId>maven-enforcer-plugin</artifactId>
656+
<version>3.3.0</version>
657+
<executions>
658+
<execution>
659+
<id>enforce-maven</id>
660+
<goals>
661+
<goal>enforce</goal>
662+
</goals>
663+
<configuration>
664+
<rules>
665+
<requireMavenVersion>
666+
<version>3.2.5</version>
667+
</requireMavenVersion>
668+
</rules>
669+
</configuration>
670+
</execution>
671+
</executions>
672+
</plugin>
654673
</plugins>
655674
</build>
656675
<distributionManagement>
@@ -669,7 +688,7 @@
669688
<plugin>
670689
<groupId>org.owasp</groupId>
671690
<artifactId>dependency-check-maven</artifactId>
672-
<version>7.2.1</version>
691+
<version>8.3.1</version>
673692
<configuration>
674693
<skipProvidedScope>true</skipProvidedScope>
675694
<skipTestScope>true</skipTestScope>

‎src/main/java/org/hyperledger/fabric/sdk/ChaincodeCollectionConfiguration.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
import org.hyperledger.fabric.protos.peer.Collection;
4343
import org.hyperledger.fabric.sdk.exception.ChaincodeCollectionConfigurationException;
4444
import org.hyperledger.fabric.sdk.exception.InvalidArgumentException;
45+
import org.yaml.snakeyaml.LoaderOptions;
4546
import org.yaml.snakeyaml.Yaml;
4647
import org.yaml.snakeyaml.constructor.SafeConstructor;
4748

@@ -117,7 +118,7 @@ public static ChaincodeCollectionConfiguration fromYamlStream(InputStream config
117118
throw new InvalidArgumentException("ConfigStream must be specified");
118119
}
119120

120-
Yaml yaml = new Yaml(new SafeConstructor());
121+
Yaml yaml = new Yaml(new SafeConstructor(new LoaderOptions()));
121122

122123
List<Object> map = yaml.load(configStream);
123124

‎src/main/java/org/hyperledger/fabric/sdk/ChaincodeEndorsementPolicy.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
import org.hyperledger.fabric.protos.common.Policies;
3737
import org.hyperledger.fabric.protos.common.Policies.SignaturePolicy;
3838
import org.hyperledger.fabric.sdk.exception.ChaincodeEndorsementPolicyParseException;
39+
import org.yaml.snakeyaml.LoaderOptions;
3940
import org.yaml.snakeyaml.Yaml;
4041
import org.yaml.snakeyaml.constructor.SafeConstructor;
4142

@@ -255,7 +256,7 @@ public static ChaincodeEndorsementPolicy fromYamlFile(Path yamlPolicyFile) throw
255256
}
256257

257258
private static Policies.SignaturePolicyEnvelope loadPolicyFromYaml(Reader yamlReader) throws ChaincodeEndorsementPolicyParseException {
258-
Yaml yaml = new Yaml(new SafeConstructor());
259+
Yaml yaml = new Yaml(new SafeConstructor(new LoaderOptions()));
259260
Map<?, Map<?, ?>> load = yaml.load(yamlReader);
260261

261262
Map<?, ?> mp = load.get("policy");

‎src/main/java/org/hyperledger/fabric/sdk/LifecycleChaincodeEndorsementPolicy.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import java.io.FileInputStream;
1212
import java.io.IOException;
1313
import java.io.InputStream;
14+
import java.nio.file.Files;
1415
import java.nio.file.Path;
1516
import java.util.HashMap;
1617
import java.util.LinkedHashMap;
@@ -28,6 +29,7 @@
2829
import org.hyperledger.fabric.protos.common.Policies.SignaturePolicy;
2930
import org.hyperledger.fabric.protos.peer.Policy;
3031
import org.hyperledger.fabric.sdk.exception.ChaincodeEndorsementPolicyParseException;
32+
import org.yaml.snakeyaml.LoaderOptions;
3133
import org.yaml.snakeyaml.Yaml;
3234
import org.yaml.snakeyaml.constructor.SafeConstructor;
3335

@@ -225,8 +227,8 @@ private static IndexedHashMap<String, MSPPrincipal> parseIdentities(Map<?, ?> id
225227
// }
226228

227229
public static LifecycleChaincodeEndorsementPolicy fromSignaturePolicyYamlFile(Path yamlPolicyFile) throws IOException, ChaincodeEndorsementPolicyParseException {
228-
final Yaml yaml = new Yaml(new SafeConstructor());
229-
final Map<?, ?> load = (Map<?, ?>) yaml.load(new FileInputStream(yamlPolicyFile.toFile()));
230+
final Yaml yaml = new Yaml(new SafeConstructor(new LoaderOptions()));
231+
final Map<?, ?> load = (Map<?, ?>) yaml.load(Files.newInputStream(yamlPolicyFile.toFile().toPath()));
230232

231233
Map<?, ?> mp = (Map<?, ?>) load.get("policy");
232234

‎src/main/java/org/hyperledger/fabric/sdk/NetworkConfig.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@
5858
import org.hyperledger.fabric.sdk.exception.NetworkConfigurationException;
5959
import org.hyperledger.fabric.sdk.helper.Utils;
6060
import org.hyperledger.fabric.sdk.identity.X509Enrollment;
61+
import org.yaml.snakeyaml.LoaderOptions;
6162
import org.yaml.snakeyaml.Yaml;
6263
import org.yaml.snakeyaml.constructor.SafeConstructor;
6364

@@ -302,7 +303,7 @@ public static NetworkConfig fromYamlStream(InputStream configStream) throws Netw
302303
throw new IllegalArgumentException("configStream must be specified");
303304
}
304305

305-
Yaml yaml = new Yaml(new SafeConstructor());
306+
Yaml yaml = new Yaml(new SafeConstructor(new LoaderOptions()));
306307

307308
Map<String, Object> map = yaml.load(configStream);
308309

0 commit comments

Comments
 (0)