Skip to content

Commit b2e318b

Browse files
CBL-Mariner-BotKanishk-BansalKanishk Bansal
authored
[AUTO-CHERRYPICK] Upgrade maven to 3.8.1 to fix CVE-2021-26291 in javapackages-bootstrap [Critical] - branch main (#13777)
Signed-off-by: Kanishk Bansal <[email protected]> Co-authored-by: Kanishk Bansal <[email protected]> Co-authored-by: Kanishk Bansal <[email protected]>
1 parent 1af2b08 commit b2e318b

File tree

3 files changed

+231
-7
lines changed

3 files changed

+231
-7
lines changed

‎SPECS/javapackages-bootstrap/CVE-2021-26291.patch

Lines changed: 217 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,217 @@
1+
From 3291b840445ecc468bddf6dbb4d782b9b79146b7 Mon Sep 17 00:00:00 2001
2+
From: mkoncek <[email protected]>
3+
Date: Fri, 17 Dec 2021 12:45:52 +0100
4+
Subject: [PATCH] Update maven to 3.8.4
5+
6+
---
7+
mbi/dist/metadata.txt | 1 +
8+
.../0003-Port-to-maven-3.8.1.patch | 59 +++++++++++++++++++
9+
.../0003-Port-to-maven-3.8.1.patch | 33 +++++++++++
10+
project/maven.properties | 2 +-
11+
project/maven.xml | 4 +-
12+
5 files changed, 97 insertions(+), 2 deletions(-)
13+
create mode 100644 patches/maven-artifact-transfer/0003-Port-to-maven-3.8.1.patch
14+
create mode 100644 patches/maven-plugin-testing/0003-Port-to-maven-3.8.1.patch
15+
16+
diff --git a/mbi/dist/metadata.txt b/mbi/dist/metadata.txt
17+
index 90f4c62..8f4d49c 100644
18+
--- a/mbi/dist/metadata.txt
19+
+++ b/mbi/dist/metadata.txt
20+
@@ -328,6 +328,7 @@ MOD maven-core
21+
DEP org.codehaus.plexus plexus-classworlds
22+
DEP org.codehaus.plexus plexus-component-annotations
23+
DEP org.apache.commons commons-lang3
24+
+ DEP org.slf4j slf4j-api
25+
MOD maven-dependency-analyzer
26+
ART org.apache.maven.shared maven-dependency-analyzer
27+
DEP org.ow2.asm asm
28+
diff --git a/patches/maven-artifact-transfer/0003-Port-to-maven-3.8.1.patch b/patches/maven-artifact-transfer/0003-Port-to-maven-3.8.1.patch
29+
new file mode 100644
30+
index 0000000..afeef3c
31+
--- /dev/null
32+
+++ b/patches/maven-artifact-transfer/0003-Port-to-maven-3.8.1.patch
33+
@@ -0,0 +1,59 @@
34+
+From 801cdd23a9dd9e8948f516537b0f5f09a252c5b7 Mon Sep 17 00:00:00 2001
35+
+From: Marian Koncek <[email protected]>
36+
+Date: Fri, 17 Dec 2021 13:33:49 +0100
37+
+Subject: [PATCH] Port to maven 3.8.1
38+
+
39+
+---
40+
+ .../internal/Maven31ArtifactRepositoryAdapter.java | 12 ++++++++++++
41+
+ .../internal/Maven31ArtifactRepositoryAdapter.java | 12 ++++++++++++
42+
+ 2 files changed, 24 insertions(+)
43+
+
44+
+diff --git a/src/main/java/org/apache/maven/shared/transfer/collection/internal/Maven31ArtifactRepositoryAdapter.java b/src/main/java/org/apache/maven/shared/transfer/collection/internal/Maven31ArtifactRepositoryAdapter.java
45+
+index 9d93f31..8297fdb 100644
46+
+--- a/src/main/java/org/apache/maven/shared/transfer/collection/internal/Maven31ArtifactRepositoryAdapter.java
47+
++++ b/src/main/java/org/apache/maven/shared/transfer/collection/internal/Maven31ArtifactRepositoryAdapter.java
48+
+@@ -207,6 +207,18 @@ class Maven31ArtifactRepositoryAdapter implements ArtifactRepository
49+
+ throw new UnsupportedOperationException();
50+
+ }
51+
+
52+
++ @Override
53+
++ public boolean isBlocked()
54+
++ {
55+
++ throw new UnsupportedOperationException();
56+
++ }
57+
++
58+
++ @Override
59+
++ public void setBlocked(boolean blocked)
60+
++ {
61+
++ throw new UnsupportedOperationException();
62+
++ }
63+
++
64+
+ @Override
65+
+ public String toString()
66+
+ {
67+
+diff --git a/src/main/java/org/apache/maven/shared/transfer/dependencies/collect/internal/Maven31ArtifactRepositoryAdapter.java b/src/main/java/org/apache/maven/shared/transfer/dependencies/collect/internal/Maven31ArtifactRepositoryAdapter.java
68+
+index d5716bb..4669353 100644
69+
+--- a/src/main/java/org/apache/maven/shared/transfer/dependencies/collect/internal/Maven31ArtifactRepositoryAdapter.java
70+
++++ b/src/main/java/org/apache/maven/shared/transfer/dependencies/collect/internal/Maven31ArtifactRepositoryAdapter.java
71+
+@@ -207,6 +207,18 @@ class Maven31ArtifactRepositoryAdapter implements ArtifactRepository
72+
+ throw new UnsupportedOperationException();
73+
+ }
74+
+
75+
++ @Override
76+
++ public boolean isBlocked()
77+
++ {
78+
++ throw new UnsupportedOperationException();
79+
++ }
80+
++
81+
++ @Override
82+
++ public void setBlocked(boolean blocked)
83+
++ {
84+
++ throw new UnsupportedOperationException();
85+
++ }
86+
++
87+
+ @Override
88+
+ public String toString()
89+
+ {
90+
+--
91+
+2.31.1
92+
+
93+
diff --git a/patches/maven-plugin-testing/0003-Port-to-maven-3.8.1.patch b/patches/maven-plugin-testing/0003-Port-to-maven-3.8.1.patch
94+
new file mode 100644
95+
index 0000000..2786be2
96+
--- /dev/null
97+
+++ b/patches/maven-plugin-testing/0003-Port-to-maven-3.8.1.patch
98+
@@ -0,0 +1,33 @@
99+
+From 4dc38f384dab2d825e1ab6f7df018650b6aeded1 Mon Sep 17 00:00:00 2001
100+
+From: Marian Koncek <[email protected]>
101+
+Date: Fri, 17 Dec 2021 13:42:11 +0100
102+
+Subject: [PATCH] Port to maven 3.8.1
103+
+
104+
+---
105+
+ .../plugin/testing/stubs/StubArtifactRepository.java | 12 ++++++++++++
106+
+ 1 file changed, 12 insertions(+)
107+
+
108+
+diff --git a/maven-plugin-testing-harness/src/main/java/org/apache/maven/plugin/testing/stubs/StubArtifactRepository.java b/maven-plugin-testing-harness/src/main/java/org/apache/maven/plugin/testing/stubs/StubArtifactRepository.java
109+
+index 9a435b7..c13c3a8 100644
110+
+--- a/maven-plugin-testing-harness/src/main/java/org/apache/maven/plugin/testing/stubs/StubArtifactRepository.java
111+
++++ b/maven-plugin-testing-harness/src/main/java/org/apache/maven/plugin/testing/stubs/StubArtifactRepository.java
112+
+@@ -247,4 +247,16 @@ public class StubArtifactRepository
113+
+ {
114+
+ // no op
115+
+ }
116+
++
117+
++ @Override
118+
++ public boolean isBlocked()
119+
++ {
120+
++ throw new UnsupportedOperationException();
121+
++ }
122+
++
123+
++ @Override
124+
++ public void setBlocked(boolean blocked)
125+
++ {
126+
++ throw new UnsupportedOperationException();
127+
++ }
128+
+ }
129+
+--
130+
+2.31.1
131+
+
132+
diff --git a/project/maven.properties b/project/maven.properties
133+
index e5a3c6b..b6ddc64 100644
134+
--- a/project/maven.properties
135+
+++ b/project/maven.properties
136+
@@ -1,3 +1,3 @@
137+
url=https://github.com/apache/maven.git
138+
ref=maven-@.@.@
139+
-version=3.6.3
140+
+version=3.8.1
141+
diff --git a/project/maven.xml b/project/maven.xml
142+
index 508bfb1..664f79b 100644
143+
--- a/project/maven.xml
144+
+++ b/project/maven.xml
145+
@@ -82,6 +82,7 @@
146+
<dependency>maven-shared-utils</dependency>
147+
<dependency>commons-lang</dependency>
148+
<dependency>maven-resolver-provider</dependency>
149+
+ <dependency>slf4j</dependency>
150+
<build>
151+
<modello>
152+
<model>src/main/mdo/toolchains.mdo</model>
153+
@@ -214,6 +215,7 @@
154+
<dependency>maven-model-builder</dependency>
155+
<dependency>guice</dependency>
156+
<dependency>maven-builder-support</dependency>
157+
+ <dependency>slf4j</dependency>
158+
<build>
159+
<compiler>
160+
<addSourceRoot>src/main/java</addSourceRoot>
161+
@@ -244,7 +246,7 @@
162+
<build>
163+
<modello>
164+
<model>src/main/mdo/settings.mdo</model>
165+
- <version>1.1.0</version>
166+
+ <version>1.2.0</version>
167+
<output>java|xpp3-reader|xpp3-writer</output>
168+
</modello>
169+
<compiler>
170+
From bd8826af4fd489a5d6ed117173904f02775415ee Mon Sep 17 00:00:00 2001
171+
From: Sindhu Karri <[email protected]>
172+
Date: Thu, 25 Jul 2024 11:33:17 +0000
173+
Subject: [PATCH] Maven resolver patch
174+
175+
---
176+
project/maven-resolver.xml | 1 +
177+
1 file changed, 1 insertion(+)
178+
179+
diff --git a/project/maven-resolver.xml b/project/maven-resolver.xml
180+
index 9f23efc..a08fc61 100644
181+
--- a/project/maven-resolver.xml
182+
+++ b/project/maven-resolver.xml
183+
@@ -20,6 +20,7 @@
184+
<addSourceRoot>maven-resolver-util/src/main/java</addSourceRoot>
185+
<addSourceRoot>maven-resolver-connector-basic/src/main/java</addSourceRoot>
186+
<addSourceRoot>maven-resolver-transport-wagon/src/main/java</addSourceRoot>
187+
+ <addSourceRoot>maven-resolver-named-locks/src/main/java</addSourceRoot>
188+
</compiler>
189+
<cdc/>
190+
</build>
191+
--
192+
2.33.8
193+
194+
From b23d2957440cb4ff06a289b4864f782794b45f52 Mon Sep 17 00:00:00 2001
195+
From: Marian Koncek <[email protected]>
196+
Date: Fri, 17 Dec 2021 13:05:49 +0100
197+
Subject: [PATCH] Port to maven-resolver 1.7.2
198+
199+
---
200+
.../org/apache/maven/repository/internal/MavenAetherModule.java | 2 +-
201+
1 file changed, 1 insertion(+), 1 deletion(-)
202+
203+
diff --git a/downstream/maven/maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/MavenAetherModule.java b/downstream/maven/maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/MavenAetherModule.java
204+
index 41e98aaea..d72e3c0f3 100644
205+
--- a/downstream/maven/maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/MavenAetherModule.java
206+
+++ b/downstream/maven/maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/MavenAetherModule.java
207+
@@ -28,7 +28,7 @@
208+
209+
import org.apache.maven.model.building.DefaultModelBuilderFactory;
210+
import org.apache.maven.model.building.ModelBuilder;
211+
-import org.eclipse.aether.impl.AetherModule;
212+
+import org.eclipse.aether.impl.guice.AetherModule;
213+
import org.eclipse.aether.impl.ArtifactDescriptorReader;
214+
import org.eclipse.aether.impl.MetadataGeneratorFactory;
215+
import org.eclipse.aether.impl.VersionRangeResolver;
216+
--
217+
2.31.1

‎SPECS/javapackages-bootstrap/javapackages-bootstrap.signatures.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@
6464
"maven-plugin-testing.tar.xz": "0bc167583eef4321b69d7990d3cb0f2c9e03f7c92137aae0c938c1b6f01798a1",
6565
"maven-plugin-tools.tar.xz": "27a3b5835a34712862b00b3f540fda541c6a54d841988b0a3dec7f02e9a3db11",
6666
"maven-remote-resources-plugin.tar.xz": "e0b8cd3eb4ec00652b44da236b2c4eb796a8f99f89b9f02dbdb290e712854a08",
67-
"maven-resolver.tar.xz": "f9722a31915945fa533995a642f7cee00f5e78ba8c4dfae6ad5f3e84fcbb1f87",
67+
"maven-resolver-1.7.0.tar.xz": "d25fed747363399d91ab1dd19de01bf9c5eb288db17dc9262d844643dd2a2127",
6868
"maven-resources-plugin.tar.xz": "a61514bcf9216c4543c8710dc0c1a7fdf7c4ecdebb1c1de118a2db536142fd9d",
6969
"maven-resources.tar.xz": "cee8b36b3869a40c8fee6e7f01105c835ab192361e9abb5bdd23a706b979b3c1",
7070
"maven-shared-incremental.tar.xz": "951c4c7cf5d4a5a40d47c213c711e76e369cfca4bfd2e55075996706f175af92",
@@ -74,7 +74,7 @@
7474
"maven-surefire.tar.xz": "2f6b7af5b523949ba194ed61774a336cf88b64cdb81753eb73d0b6a94375ff52",
7575
"maven-verifier.tar.xz": "bfd78b31d226bead42b88ae787c310b42aa57b3f64e68652a4e88b0d0f3b49c9",
7676
"maven-wagon.tar.xz": "a34b0a40dd7bc566a284858613c875c5534f80a7c2afd2c3e503e2385728d131",
77-
"maven.tar.xz": "9041ac7dda108625e159504f14e4d42375a1b2f0cf257a3b3c2ec4f0bd910d9e",
77+
"maven-3.8.1.tar.xz": "65ea8259df08175343593daf6663e2c8a739d75a8d4ef76f0f7d23e15b06e40a",
7878
"mockito.tar.xz": "7b35153653525935f7e6a039dbe608a1058b139e9e6b5f3b6d0362ff114fe77f",
7979
"modello.tar.xz": "be90712a48c4305d9e2ea4d35729d2a2b505ea25512fc3014234d9ac1ec6e46c",
8080
"mojo-parent-pom.tar.xz": "23e97b26ff8efd391bccd0cf215bb0ec2e7ac6caf2b9394b61766bfb9b110bb7",

‎SPECS/javapackages-bootstrap/javapackages-bootstrap.spec

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
Name: javapackages-bootstrap
1515
Version: 1.5.0
16-
Release: 6%{?dist}
16+
Release: 7%{?dist}
1717
Summary: A means of bootstrapping Java Packages Tools
1818
# For detailed info see the file javapackages-bootstrap-PACKAGE-LICENSING
1919
License: ASL 2.0 and ASL 1.1 and (ASL 2.0 or EPL-2.0) and (EPL-2.0 or GPLv2 with exceptions) and MIT and (BSD with advertising) and BSD-3-Clause and EPL-1.0 and EPL-2.0 and CDDL-1.0 and xpp and CC0 and Public Domain
@@ -87,7 +87,7 @@ Source1057: maven-parent-pom.tar.xz
8787
Source1058: maven-plugin-testing.tar.xz
8888
Source1059: maven-plugin-tools.tar.xz
8989
Source1060: maven-remote-resources-plugin.tar.xz
90-
Source1061: maven-resolver.tar.xz
90+
Source1061: maven-resolver-1.7.0.tar.xz
9191
Source1062: maven-resources-plugin.tar.xz
9292
Source1063: maven-resources.tar.xz
9393
Source1064: maven-shared-incremental.tar.xz
@@ -97,7 +97,7 @@ Source1067: maven-source-plugin.tar.xz
9797
Source1068: maven-surefire.tar.xz
9898
Source1069: maven-verifier.tar.xz
9999
Source1070: maven-wagon.tar.xz
100-
Source1071: maven.tar.xz
100+
Source1071: maven-3.8.1.tar.xz
101101
Source1072: mockito.tar.xz
102102
Source1073: modello.tar.xz
103103
Source1074: mojo-parent-pom.tar.xz
@@ -141,6 +141,7 @@ Patch1: 0001-Remove-usage-of-ArchiveStreamFactory.patch
141141
Patch2: CVE-2023-37460.patch
142142
Patch3: Internal-Java-API.patch
143143
Patch4: CVE-2021-36373.patch
144+
Patch5: CVE-2021-26291.patch
144145

145146
Provides: bundled(ant) = 1.10.9
146147
Provides: bundled(apache-parent) = 23
@@ -202,7 +203,7 @@ Provides: bundled(maven-parent) = 34
202203
Provides: bundled(maven-plugin-testing) = 3.3.0
203204
Provides: bundled(maven-plugin-tools) = 3.6.0
204205
Provides: bundled(maven-remote-resources-plugin) = 1.7.0
205-
Provides: bundled(maven-resolver) = 1.6.1
206+
Provides: bundled(maven-resolver) = 1.7.0
206207
Provides: bundled(maven-resources-plugin) = 3.2.0
207208
Provides: bundled(maven-resources) = 1.4
208209
Provides: bundled(maven-shared-incremental) = 1.1
@@ -212,7 +213,7 @@ Provides: bundled(maven-source-plugin) = 3.2.1
212213
Provides: bundled(maven-surefire) = 3.0.0~M3
213214
Provides: bundled(maven-verifier) = 1.7.2
214215
Provides: bundled(maven-wagon) = 3.4.2
215-
Provides: bundled(maven) = 3.6.3
216+
Provides: bundled(maven) = 3.8.1
216217
Provides: bundled(mockito) = 3.7.13
217218
Provides: bundled(modello) = 1.11
218219
Provides: bundled(mojo-parent) = 60
@@ -305,6 +306,8 @@ pushd "downstream/ant"
305306
%patch4 -p1
306307
popd
307308

309+
%patch5 -p1
310+
308311
# remove guava.xml from javapackage-bootstrap 1.5.0
309312
# import guava.xml 32.1.3 from Fedora 40
310313
# edit version from guava.properties
@@ -389,6 +392,10 @@ sed -i 's|/usr/lib/jvm/java-11-openjdk|%{java_home}|' %{buildroot}%{launchersPat
389392
%doc AUTHORS
390393

391394
%changelog
395+
* Tue May 13 2025 Kanishk Bansal <[email protected]> - 1.5.0-7
396+
- Update maven to 3.8.1 and maven-resolver to 1.7.0 to fix CVE-2021-26291
397+
- Add the CVE-2021-26291.patch to enable these upgrades
398+
392399
* Wed Feb 26 2025 Kshitiz Godara <[email protected]> - 1.5.0-6
393400
- Patch CVE-2021-36373 and CVE-2021-36374.
394401

0 commit comments

Comments
 (0)