From e668103b489bfa044a09a90d29ba9386480b80c9 Mon Sep 17 00:00:00 2001 From: ADOT Patch workflow Date: Wed, 25 Mar 2026 19:12:39 -0700 Subject: [PATCH 1/3] fix high severity CVEs --- .github/dependency-check-suppressions.xml | 21 ++++++++++++++++++ .github/trivy/daily-scan.trivyignore.yaml | 22 +++++++++++++++++-- .../build.gradle.kts | 15 ++++++++----- aws-xray-recorder-sdk-spring/build.gradle.kts | 6 ++--- dependencyManagement/build.gradle.kts | 4 ++-- 5 files changed, 55 insertions(+), 13 deletions(-) diff --git a/.github/dependency-check-suppressions.xml b/.github/dependency-check-suppressions.xml index fbf9371b..061f1c6f 100644 --- a/.github/dependency-check-suppressions.xml +++ b/.github/dependency-check-suppressions.xml @@ -1,3 +1,24 @@ + + + + .*aws-xray-recorder-sdk-sql-mysql.* + cpe:/a:mysql:mysql + + + + .*aws-xray-recorder-sdk-sql-mysql.* + cpe:/a:www-sql_project:www-sql + + + + + .*jackson-databind.* + CVE-2023-35116 + diff --git a/.github/trivy/daily-scan.trivyignore.yaml b/.github/trivy/daily-scan.trivyignore.yaml index 940269c2..5c8bcff7 100644 --- a/.github/trivy/daily-scan.trivyignore.yaml +++ b/.github/trivy/daily-scan.trivyignore.yaml @@ -2,7 +2,6 @@ # SPDX-License-Identifier: Apache-2.0 # Trivy ignore file for daily scans. -# This file is intentionally empty. Daily scans should flag all CVEs. # See: https://aquasecurity.github.io/trivy/latest/docs/configuration/filtering/ # Format: @@ -10,4 +9,23 @@ # statement: " " # expired_at: -vulnerabilities: [] +vulnerabilities: + # AWS SDK v1 (com.amazonaws:aws-java-sdk-core:1.12.788) embeds jackson-core 2.12.7 + # in its published POM. AWS SDK v1 reached EOL on 2025-12-31 and will not receive + # jackson updates. The X-Ray SDK's own jackson BOM (2.18.6) ensures the actual + # jackson JAR on the classpath is patched — these findings are from the third-party + # POM metadata only, not from the actual JARs resolved at runtime. + - id: CVE-2025-52999 + paths: + - "META-INF/maven/com.amazonaws/aws-java-sdk-core/pom.xml" + - "META-INF/maven/com.amazonaws/aws-java-sdk-xray/pom.xml" + - "META-INF/maven/com.amazonaws/jmespath-java/pom.xml" + statement: "AWS SDK v1 EOL — jackson-core 2.12.7 in POM metadata only. Actual runtime JAR is 2.18.6 via X-Ray SDK BOM." + expired_at: 2027-03-25 + - id: GHSA-72hv-8253-57qq + paths: + - "META-INF/maven/com.amazonaws/aws-java-sdk-core/pom.xml" + - "META-INF/maven/com.amazonaws/aws-java-sdk-xray/pom.xml" + - "META-INF/maven/com.amazonaws/jmespath-java/pom.xml" + statement: "AWS SDK v1 EOL — jackson-core 2.12.7 in POM metadata only. Actual runtime JAR is 2.18.6 via X-Ray SDK BOM." + expired_at: 2027-03-25 diff --git a/aws-xray-recorder-sdk-aws-sdk-v2/build.gradle.kts b/aws-xray-recorder-sdk-aws-sdk-v2/build.gradle.kts index bd3007d3..a5c030ae 100644 --- a/aws-xray-recorder-sdk-aws-sdk-v2/build.gradle.kts +++ b/aws-xray-recorder-sdk-aws-sdk-v2/build.gradle.kts @@ -8,14 +8,17 @@ dependencies { implementation(project(":aws-xray-recorder-sdk-aws-sdk-core")) - api("software.amazon.awssdk:aws-core:2.15.20") + api("software.amazon.awssdk:aws-core:2.30.31") + + implementation("com.fasterxml.jackson.core:jackson-databind") + implementation("com.fasterxml.jackson.core:jackson-core") testImplementation("org.skyscreamer:jsonassert:1.3.0") - testImplementation("software.amazon.awssdk:dynamodb:2.15.20") - testImplementation("software.amazon.awssdk:lambda:2.15.20") - testImplementation("software.amazon.awssdk:sqs:2.15.20") - testImplementation("software.amazon.awssdk:sns:2.15.20") - testImplementation("software.amazon.awssdk:s3:2.15.20") + testImplementation("software.amazon.awssdk:dynamodb:2.30.31") + testImplementation("software.amazon.awssdk:lambda:2.30.31") + testImplementation("software.amazon.awssdk:sqs:2.30.31") + testImplementation("software.amazon.awssdk:sns:2.30.31") + testImplementation("software.amazon.awssdk:s3:2.30.31") } tasks.jar { diff --git a/aws-xray-recorder-sdk-spring/build.gradle.kts b/aws-xray-recorder-sdk-spring/build.gradle.kts index f9ea1232..277a96e4 100644 --- a/aws-xray-recorder-sdk-spring/build.gradle.kts +++ b/aws-xray-recorder-sdk-spring/build.gradle.kts @@ -9,9 +9,9 @@ dependencies { api("org.aspectj:aspectjrt:1.8.11") // TODO(anuraaga): Remove most of these? Seems only Configurable annotation is used - implementation("org.springframework:spring-context-support:5.3.18") - implementation("org.springframework:spring-context:5.3.18") - implementation("org.springframework:spring-aspects:5.3.18") + implementation("org.springframework:spring-context-support:5.3.39") + implementation("org.springframework:spring-context:5.3.39") + implementation("org.springframework:spring-aspects:5.3.39") compileOnly("org.springframework.data:spring-data-commons:2.6.3") } diff --git a/dependencyManagement/build.gradle.kts b/dependencyManagement/build.gradle.kts index daf701e9..ac32fc23 100644 --- a/dependencyManagement/build.gradle.kts +++ b/dependencyManagement/build.gradle.kts @@ -5,14 +5,14 @@ plugins { data class DependencySet(val group: String, val version: String, val modules: List) val DEPENDENCY_BOMS = listOf( - "com.fasterxml.jackson:jackson-bom:2.12.0", + "com.fasterxml.jackson:jackson-bom:2.18.6", "org.junit:junit-bom:5.8.2" ) val DEPENDENCY_SETS = listOf( DependencySet( "com.fasterxml.jackson.datatype", - "2.12.0", + "2.18.6", listOf("jackson-datatype-jsr310") ), DependencySet( From 77d804aa6fa751b72dcc5bb67b16c694e443df03 Mon Sep 17 00:00:00 2001 From: ADOT Patch workflow Date: Thu, 26 Mar 2026 13:58:46 -0700 Subject: [PATCH 2/3] update trivyignore --- .github/trivy/daily-scan.trivyignore.yaml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/.github/trivy/daily-scan.trivyignore.yaml b/.github/trivy/daily-scan.trivyignore.yaml index 5c8bcff7..2ae939ce 100644 --- a/.github/trivy/daily-scan.trivyignore.yaml +++ b/.github/trivy/daily-scan.trivyignore.yaml @@ -10,22 +10,25 @@ # expired_at: vulnerabilities: - # AWS SDK v1 (com.amazonaws:aws-java-sdk-core:1.12.788) embeds jackson-core 2.12.7 - # in its published POM. AWS SDK v1 reached EOL on 2025-12-31 and will not receive - # jackson updates. The X-Ray SDK's own jackson BOM (2.18.6) ensures the actual - # jackson JAR on the classpath is patched — these findings are from the third-party - # POM metadata only, not from the actual JARs resolved at runtime. + # The AWS SDK for Java v1 (com.amazonaws:aws-java-sdk-core:1.12.788) reached EOL + # on 2025-12-31 and will not receive further releases. Its published JARs embed POM + # metadata declaring jackson-core 2.12.7 as a dependency — this cannot be changed. + # The X-Ray SDK still supports AWS SDK v1 instrumentation via the + # aws-xray-recorder-sdk-aws-sdk module, but the actual jackson-core JAR resolved + # at runtime is 2.18.6 (provided by the X-Ray SDK's own jackson BOM). Maven + # dependency mediation ensures the higher version wins. These Trivy findings are + # from third-party POM metadata only, not the actual runtime JARs. - id: CVE-2025-52999 paths: - "META-INF/maven/com.amazonaws/aws-java-sdk-core/pom.xml" - "META-INF/maven/com.amazonaws/aws-java-sdk-xray/pom.xml" - "META-INF/maven/com.amazonaws/jmespath-java/pom.xml" - statement: "AWS SDK v1 EOL — jackson-core 2.12.7 in POM metadata only. Actual runtime JAR is 2.18.6 via X-Ray SDK BOM." + statement: "AWS SDK v1 EOL (1.12.788 is final release) — jackson-core 2.12.7 in POM metadata only. Actual runtime JAR is 2.18.6 via X-Ray SDK BOM." expired_at: 2027-03-25 - id: GHSA-72hv-8253-57qq paths: - "META-INF/maven/com.amazonaws/aws-java-sdk-core/pom.xml" - "META-INF/maven/com.amazonaws/aws-java-sdk-xray/pom.xml" - "META-INF/maven/com.amazonaws/jmespath-java/pom.xml" - statement: "AWS SDK v1 EOL — jackson-core 2.12.7 in POM metadata only. Actual runtime JAR is 2.18.6 via X-Ray SDK BOM." + statement: "AWS SDK v1 EOL (1.12.788 is final release) — jackson-core 2.12.7 in POM metadata only. Actual runtime JAR is 2.18.6 via X-Ray SDK BOM." expired_at: 2027-03-25 From b6207239981e2a565ba753f60af516a50852c9ab Mon Sep 17 00:00:00 2001 From: ADOT Patch workflow Date: Thu, 26 Mar 2026 14:57:50 -0700 Subject: [PATCH 3/3] fix SQL test to use JSON protocol --- .../interceptors/TracingInterceptorTest.java | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/aws-xray-recorder-sdk-aws-sdk-v2/src/test/java/com/amazonaws/xray/interceptors/TracingInterceptorTest.java b/aws-xray-recorder-sdk-aws-sdk-v2/src/test/java/com/amazonaws/xray/interceptors/TracingInterceptorTest.java index 2591effd..9e52d419 100644 --- a/aws-xray-recorder-sdk-aws-sdk-v2/src/test/java/com/amazonaws/xray/interceptors/TracingInterceptorTest.java +++ b/aws-xray-recorder-sdk-aws-sdk-v2/src/test/java/com/amazonaws/xray/interceptors/TracingInterceptorTest.java @@ -173,14 +173,15 @@ public void testResponseDescriptors() throws Exception { @Test public void testSqsSendMessageSubsegmentContainsQueueUrl() throws Exception { - SdkHttpClient mockClient = mockClientWithSuccessResponse( - "" + - "" + - "b10a8db164e0754105b7a99be72e3fe5" + - "abc-def-ghi" + - "" + - "123-456-789" + - "" + SdkHttpResponse mockResponse = SdkHttpResponse.builder() + .statusCode(200) + .putHeader("x-amzn-RequestId", "123-456-789") + .build(); + SdkHttpClient mockClient = mockSdkHttpClient(mockResponse, + "{" + + "\"MD5OfMessageBody\":\"b10a8db164e0754105b7a99be72e3fe5\"," + + "\"MessageId\":\"abc-def-ghi\"" + + "}" ); SqsClient client = sqsClient(mockClient);