Lots of vulnerabilities in dependencies

[markAtAthena]

Describe the bug

Scan Results: fe56677a-a9df-4370-bce6-d2cfe71debba

Scan Results for Scan ID: fe56677a-a9df-4370-bce6-d2cfe71debba

CRITICAL Findings: 1

Maven-org.simpleframework:simple-xml-2.7.1
CVE: CVE-2017-1000190
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-identity-1.3.1, Maven-org.linguafranca.pwdb:KeePassJava2-2.1.4, Maven-org.linguafranca.pwdb:KeePassJava2-simple-2.1.4, Maven-org.simpleframework:simple-xml-2.7.1

---

HIGH Findings: 24

Maven-io.netty:netty-resolver-dns-4.1.63.Final
CVE: CVE-2024-47535
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-core-http-netty-1.10.1, Maven-io.projectreactor.netty:reactor-netty-1.0.7, Maven-io.projectreactor.netty:reactor-netty-core-1.0.7, Maven-io.netty:netty-resolver-dns-4.1.63.Final

---

Maven-io.netty:netty-common-4.1.65.Final
CVE: CVE-2024-47535
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-core-http-netty-1.10.1, Maven-io.netty:netty-handler-4.1.65.Final, Maven-io.netty:netty-common-4.1.65.Final

---

Maven-com.fasterxml.jackson.core:jackson-databind-2.12.3
CVE: CVE-2020-36518
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-core-1.18.0, Maven-com.fasterxml.jackson.core:jackson-databind-2.12.3
Maven-com.azure:azure-core-http-netty-1.10.1, Maven-com.azure:azure-core-1.18.0, Maven-com.fasterxml.jackson.core:jackson-databind-2.12.3

---

Maven-net.minidev:json-smart-2.4.2
CVE: CVE-2021-31684
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-identity-1.3.1, Maven-com.microsoft.azure:msal4j-1.10.0, Maven-com.nimbusds:oauth2-oidc-sdk-9.4, Maven-net.minidev:json-smart-2.4.2

---

Maven-io.netty:netty-codec-4.1.65.Final
CVE: CVE-2021-37136
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-core-http-netty-1.10.1, Maven-io.netty:netty-handler-4.1.65.Final, Maven-io.netty:netty-codec-4.1.65.Final

---

Maven-io.netty:netty-codec-4.1.65.Final
CVE: CVE-2021-37137
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-core-http-netty-1.10.1, Maven-io.netty:netty-handler-4.1.65.Final, Maven-io.netty:netty-codec-4.1.65.Final

---

Maven-com.fasterxml.jackson.core:jackson-databind-2.12.3
CVE: CVE-2021-46877
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-core-1.18.0, Maven-com.fasterxml.jackson.core:jackson-databind-2.12.3
Maven-com.azure:azure-core-http-netty-1.10.1, Maven-com.azure:azure-core-1.18.0, Maven-com.fasterxml.jackson.core:jackson-databind-2.12.3

---

Maven-com.google.code.gson:gson-2.8.6
CVE: CVE-2022-25647
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-io.opentelemetry:opentelemetry-exporter-jaeger-1.0.0, Maven-com.google.protobuf:protobuf-java-util-3.14.0, Maven-com.google.code.gson:gson-2.8.6

---

Maven-com.google.protobuf:protobuf-java-3.14.0
CVE: CVE-2022-3171
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-io.opentelemetry:opentelemetry-exporter-jaeger-1.0.0, Maven-com.google.protobuf:protobuf-java-3.14.0

---

Maven-com.google.protobuf:protobuf-java-3.14.0
CVE: CVE-2022-3509
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-io.opentelemetry:opentelemetry-exporter-jaeger-1.0.0, Maven-com.google.protobuf:protobuf-java-3.14.0

---

Maven-com.google.protobuf:protobuf-java-3.14.0
CVE: CVE-2022-3510
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-io.opentelemetry:opentelemetry-exporter-jaeger-1.0.0, Maven-com.google.protobuf:protobuf-java-3.14.0

---

Maven-com.fasterxml.woodstox:woodstox-core-6.2.4
CVE: CVE-2022-40152
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-core-1.18.0, Maven-com.fasterxml.jackson.dataformat:jackson-dataformat-xml-2.12.3, Maven-com.fasterxml.woodstox:woodstox-core-6.2.4
Maven-com.azure:azure-core-http-netty-1.10.1, Maven-com.azure:azure-core-1.18.0, Maven-com.fasterxml.jackson.dataformat:jackson-dataformat-xml-2.12.3, Maven-com.fasterxml.woodstox:woodstox-core-6.2.4

---

Maven-com.fasterxml.jackson.core:jackson-databind-2.12.3
CVE: CVE-2022-42003
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-core-1.18.0, Maven-com.fasterxml.jackson.core:jackson-databind-2.12.3
Maven-com.azure:azure-core-http-netty-1.10.1, Maven-com.azure:azure-core-1.18.0, Maven-com.fasterxml.jackson.core:jackson-databind-2.12.3

---

Maven-com.fasterxml.jackson.core:jackson-databind-2.12.3
CVE: CVE-2022-42004
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-core-1.18.0, Maven-com.fasterxml.jackson.core:jackson-databind-2.12.3
Maven-com.azure:azure-core-http-netty-1.10.1, Maven-com.azure:azure-core-1.18.0, Maven-com.fasterxml.jackson.core:jackson-databind-2.12.3

---

Maven-net.minidev:json-smart-2.4.2
CVE: CVE-2023-1370
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-identity-1.3.1, Maven-com.microsoft.azure:msal4j-1.10.0, Maven-com.nimbusds:oauth2-oidc-sdk-9.4, Maven-net.minidev:json-smart-2.4.2

---

Maven-io.projectreactor.netty:reactor-netty-core-1.0.7
CVE: CVE-2023-34054
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-core-http-netty-1.10.1, Maven-io.projectreactor.netty:reactor-netty-1.0.7, Maven-io.projectreactor.netty:reactor-netty-core-1.0.7

---

Maven-io.projectreactor.netty:reactor-netty-http-1.0.7
CVE: CVE-2023-34062
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-core-http-netty-1.10.1, Maven-io.projectreactor.netty:reactor-netty-1.0.7, Maven-io.projectreactor.netty:reactor-netty-http-1.0.7

---

Maven-io.netty:netty-codec-http2-4.1.65.Final
CVE: CVE-2023-44487
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-core-http-netty-1.10.1, Maven-io.netty:netty-codec-http2-4.1.65.Final

---

Maven-com.nimbusds:nimbus-jose-jwt-9.8.1
CVE: CVE-2023-52428
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-com.azure:azure-identity-1.3.1, Maven-com.microsoft.azure:msal4j-1.10.0, Maven-com.nimbusds:oauth2-oidc-sdk-9.4, Maven-com.nimbusds:nimbus-jose-jwt-9.8.1

---

Maven-org.springframework:spring-webmvc-6.1.13
CVE: CVE-2024-38819
Locations: pom.xml
Dependency Paths: Maven-org.springframework:spring-webmvc-6.1.13

---

Maven-com.google.protobuf:protobuf-java-3.14.0
CVE: CVE-2024-7254
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-io.opentelemetry:opentelemetry-exporter-jaeger-1.0.0, Maven-com.google.protobuf:protobuf-java-3.14.0

---

Maven-commons-collections:commons-collections-3.2.2
CVE: Cx78f40514-81ff
Locations: pom.xml
Dependency Paths: Maven-org.apache.maven.plugins:maven-site-plugin-4.0.0-M15, Maven-org.apache.maven.doxia:doxia-site-renderer-2.0.0-M19, Maven-org.apache.velocity.tools:velocity-tools-generic-3.1, Maven-commons-beanutils:commons-beanutils-1.9.4, Maven-commons-collections:commons-collections-3.2.2

---

Maven-com.google.guava:guava-31.1-jre
CVE: CVE-2023-2976
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.fasterxml.jackson.core/jackson-databind/pom.xml, lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/org.jctools/jctools-core/pom.xml
Dependency Paths: Maven-com.google.guava:guava-testlib-31.1-jre, Maven-com.google.guava:guava-31.1-jre

---

Maven-com.google.guava:guava-30.0-android
CVE: CVE-2023-2976
Locations: lib/opentelemetry-javaagent-2.11.0/inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml
Dependency Paths: Maven-io.opentelemetry:opentelemetry-exporter-jaeger-1.0.0, Maven-io.grpc:grpc-api-1.35.0, Maven-com.google.guava:guava-30.0-android

---

MEDIUM Findings: 11

LOW Findings: 10

Steps to reproduce

Run vulnerability scanner

Expected behavior

Ideally few if any issues

Actual behavior

a lot of high and one critical issue

Javaagent or library instrumentation version

2.11.0

Environment

JDK:
OS:

Additional context

No response

[trask]

hi @markAtAthena, it looks like you may be running the scanner against the entire repo (including test dependencies)?

this repo intentionally runs tests against many old dependency versions in order to ensure instrumentation compatibility with old versions of libraries

however, if you run your scanner against published artifacts, you should not see those old versions

[markAtAthena]

Hi Trask, Actually, this was a CxOne run in Jenkins against our own microservice that uses the published fat jar and I can find them bundled into the 2.11.0 jar if I expand the jar. From: Trask Stalnaker ***@***.***> Date: Monday, January 6, 2025 at 12:00 PM To: open-telemetry/opentelemetry-java-instrumentation ***@***.***> Cc: Mark Jones ***@***.***>, Mention ***@***.***> Subject: Re: [open-telemetry/opentelemetry-java-instrumentation] Lots of vulnerabilities in dependencies (Issue #13000) hi @markAtAthena, it looks like you may be running the scanner against the entire repo (including test dependencies)? this repo intentionally runs tests against many old dependency versions in order to ensure instrumentation compatibility with ZjQcmQRYFpfptBannerStart [CAUTION - EXTERNAL EMAIL ] Do not reply, click links, or open attachments unless you have verified the sender and know the content is safe. ZjQcmQRYFpfptBannerEnd hi @markAtAthena<https://urldefense.com/v3/__https:/github.com/markAtAthena__;!!E3l7wfIP!gdDNewVNXPspmsDGBV4PEMDIt-TKWKw6rwmcW5cOkXBWn8WTTbCxxo-Xvzn5G84gHc9GpdN7lSpohdIdLH4FhDA$>, it looks like you may be running the scanner against the entire repo (including test dependencies)? this repo intentionally runs tests against many old dependency versions in order to ensure instrumentation compatibility with old versions of libraries however, if you run your scanner against published artifacts, you should not see those old versions — Reply to this email directly, view it on GitHub<https://urldefense.com/v3/__https:/github.com/open-telemetry/opentelemetry-java-instrumentation/issues/13000*issuecomment-2573523418__;Iw!!E3l7wfIP!gdDNewVNXPspmsDGBV4PEMDIt-TKWKw6rwmcW5cOkXBWn8WTTbCxxo-Xvzn5G84gHc9GpdN7lSpohdIdgWjBxVY$>, or unsubscribe<https://urldefense.com/v3/__https:/github.com/notifications/unsubscribe-auth/AMOT6W5Y5T5JCXT4UA6ZEH32JKZEBAVCNFSM6AAAAABUV6Q2FCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKNZTGUZDGNBRHA__;!!E3l7wfIP!gdDNewVNXPspmsDGBV4PEMDIt-TKWKw6rwmcW5cOkXBWn8WTTbCxxo-Xvzn5G84gHc9GpdN7lSpohdIdyIMqUxw$>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[trask]

I can find them bundled into the 2.11.0 jar if I expand the jar.

which jar? e.g. the Java agent jar doesn't include netty at all (let alone the old version you mention above)

[markAtAthena]

io.opentelemetry.javaagent:opentelemetry-javaagent

is pulling it in from

inst/META-INF/maven/com.azure/azure-core-tracing-opentelemetry/pom.xml

[markAtAthena]

Though, they are scoped to test, so I wonder if this is a bug in CxOne (checkmarx one)?