fix(hadoop): CVE-2023-34455

[razvan]

Description

Assessment: https://github.com/stackabletech/vulnerabilities/issues/558

Publish image

I retagged the image to reduce the chances of it being overwritten.

$ bake -p hadoop=3.3.6 -o sandbox
$ docker tag docker.stackable.tech/sandbox/hadoop:3.3.6-stackable0.0.0-dev \
docker.stackable.tech/sandbox/hadoop:3.3.6-CVE-2023-34455
$ docker push  docker.stackable.tech/sandbox/hadoop:3.3.6-CVE-2023-34455

Trivy scan

The local trivy scan shows that this CVE is not present anymore.

$ trivy image --scanners vuln docker.stackable.tech/sandbox/hadoop:3.3.6-CVE-2023-34455 \
--format json \
--output scan.json

Trivy output:
scan.json

Integration tests

🟢 Pass

$ ./scripts/run-tests --parallel 1
...
--- PASS: kuttl (7343.95s)
    --- PASS: kuttl/harness (0.00s)
        --- PASS: kuttl/harness/logging_hadoop-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-latest-3.9.2_openshift-false (718.35s)
        --- PASS: kuttl/harness/smoke_hadoop-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-3.9.2_zookeeper-latest-3.9.2_number-of-datanodes-2_datanode-pvcs-2hdd-1ssd_listener-class-external-unstable_openshift-false (237.25s)
        --- PASS: kuttl/harness/cluster-operation_hadoop-latest-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-latest-3.9.2_openshift-false (254.06s)
        --- PASS: kuttl/harness/profiling_hadoop-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-latest-3.9.2_openshift-false (185.68s)
        --- PASS: kuttl/harness/kerberos_hadoop-latest-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-latest-3.9.2_krb5-1.21.1_kerberos-realm-PROD.MYCORP_kerberos-backend-mit_openshift-false (1377.78s)
        --- PASS: kuttl/harness/kerberos_hadoop-latest-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-latest-3.9.2_krb5-1.21.1_kerberos-realm-CLUSTER.LOCAL_kerberos-backend-mit_openshift-false (1415.49s)
        --- PASS: kuttl/harness/smoke_hadoop-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-3.9.2_zookeeper-latest-3.9.2_number-of-datanodes-2_datanode-pvcs-default_listener-class-external-unstable_openshift-false (283.94s)
        --- PASS: kuttl/harness/smoke_hadoop-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-3.9.2_zookeeper-latest-3.9.2_number-of-datanodes-2_datanode-pvcs-default_listener-class-cluster-internal_openshift-false (292.08s)
        --- PASS: kuttl/harness/smoke_hadoop-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-3.9.2_zookeeper-latest-3.9.2_number-of-datanodes-1_datanode-pvcs-2hdd-1ssd_listener-class-external-unstable_openshift-false (264.25s)
        --- PASS: kuttl/harness/smoke_hadoop-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-3.9.2_zookeeper-latest-3.9.2_number-of-datanodes-2_datanode-pvcs-2hdd-1ssd_listener-class-cluster-internal_openshift-false (1090.36s)
        --- PASS: kuttl/harness/smoke_hadoop-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-3.9.2_zookeeper-latest-3.9.2_number-of-datanodes-1_datanode-pvcs-default_listener-class-external-unstable_openshift-false (266.55s)
        --- PASS: kuttl/harness/smoke_hadoop-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-3.9.2_zookeeper-latest-3.9.2_number-of-datanodes-1_datanode-pvcs-default_listener-class-cluster-internal_openshift-false (263.97s)
        --- PASS: kuttl/harness/topology-provider_hadoop-latest-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-latest-3.9.2_krb5-1.21.1_kerberos-backend-mit_openshift-false (340.84s)
        --- PASS: kuttl/harness/smoke_hadoop-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-3.9.2_zookeeper-latest-3.9.2_number-of-datanodes-1_datanode-pvcs-2hdd-1ssd_listener-class-cluster-internal_openshift-false (205.44s)
        --- PASS: kuttl/harness/orphaned-resources_hadoop-latest-3.3.6,docker.stackable.tech_sandbox_hadoop_3.3.6-CVE-2023-34455_zookeeper-latest-3.9.2_openshift-false (147.11s)
PASS

Resolution

🟢 Trivy scan shows that the CVE is no longer present.

[razvan]

Closing since it's effectively a no-op. This PR was created on the premise that the Hive image inherits the same CVE from the Hadoop image. This is wrong. The Hadoop image doesn't expose this CVE at all since it already removes the vulnerable snappy version.