Patch release request CVE-2025-30065

[ted-jenks]

Hello,

CVE-2025-30065 is pretty hairy. It is fixed on main and we were hoping we could get a patch release to cover it.

Thanks!

[kgduong]

+1 are we able to patch release this to older versions of Iceberg?

[ajantha-bhat]

We are planning for 1.9.0 RC today. So, new version of Iceberg will be out with this CVE fix.

Regarding patch release. Are you looking for 1.8.x or 1.7.x? But this CVE exits for all previous versions.
So, it will be impractical to bump all the recent releases. Is it possible to use the latest 1.9.0 release?

@nastra : Thoughts?

[ajantha-bhat]

1.9.0 RC0 is out for voting. Which has a fix for this CVE
https://lists.apache.org/thread/fvm5dg2kd7ofm7x2xo3oyjjl9r8dcssq

[jeremysong]

@ajantha-bhat we are interested in patching 1.6.x, 1.7.x, and 1.8.x. There are two reasons we are asking for this:

1. We really need to address those security issues as soon as possible. We can't wait until 1.9.0 is out.
2. Upgrading newer version requires extensive testing on our side. It's much safer to patch the existing versions and fast track the deployment.

If we create PRs, would the community open to release the patched version to maven?

[ajantha-bhat]

If we create PRs, would the community open to release the patched version to maven?

Yes. Iceberg community welcomes patch releases independent of release cycle if there is a blocker issue like this.
Yeah, please feel free to raise a PR on branches (maybe for 1.8.x first). I am not sure about 1.7.x and 1.6.x releases yet.

One of the PMCs like @nastra or @Fokko will help in uploading the artifacts and creating the tags.

[RussellSpitzer]

@jeremysong have you finished those Pr's yet?

[akhilyendluri]

Created a pull request: #12767. This is for 1.8.x, will send another pr for 1.7 and 1.6

[akhilyendluri]

Created pull requests for 1.7 and 1.6:

1.7.x: #12778
1.6.x: #12780

[manuzhang]

I opened a discussion on dev list. Please chime in.

[RussellSpitzer]

I think your prs need a fix to the tests because some of the metrics are not the same between 13 and 15

…

On Sat, Apr 12, 2025 at 9:54 AM Manu Zhang ***@***.***> wrote: I opened a discussion on dev list <https://lists.apache.org/thread/0tnnc81p6nw2kz32oz1fscvm2ztf8wtb>. Please chime in. — Reply to this email directly, view it on GitHub <#12749 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADE2YKIGEDMS5TY5FS32PT2ZESLXAVCNFSM6AAAAAB2XNZBECVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDOOJYHA3DCOJYHE> . You are receiving this because you commented.Message ID: ***@***.***> *manuzhang* left a comment (apache/iceberg#12749) <#12749 (comment)> I opened a discussion on dev list <https://lists.apache.org/thread/0tnnc81p6nw2kz32oz1fscvm2ztf8wtb>. Please chime in. — Reply to this email directly, view it on GitHub <#12749 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADE2YKIGEDMS5TY5FS32PT2ZESLXAVCNFSM6AAAAAB2XNZBECVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDOOJYHA3DCOJYHE> . You are receiving this because you commented.Message ID: ***@***.***>

[pvary]

I think your prs need a fix to the tests because some of the metrics are
not the same between 13 and 15
…

Are these changes are breaking changes for users? Can we move forward anyway? Do we need to highlight these changes for the users?

[manuzhang]

Are these changes are breaking changes for users? Can we move forward anyway? Do we need to highlight these changes for the users?

Previously, we also updated metrics when in tests upgrading parquet from 1.13.1 to 1.14.3

[pvary]

Are these changes are breaking changes for users? Can we move forward anyway? Do we need to highlight these changes for the users?

Previously, we also updated metrics when in tests upgrading parquet from 1.13.1 to 1.14.3

If I understand correctly, that change happened for a minor release. We are talking about a patch release here, which usually has more strict compatibility guarantees. 🤔