Skip to content

Commit 4d14529

Browse files
bestbeforetodaybestbeforetoday
committed
Update dependencies to address security vulnerabilities
- CVE-2022-25647 - CVE-2023-2976 - CVE-2020-8908 Also: - Update Gradle wrapper version to resolve Gradle bug in handling certain dependency JAR files. - Update Gradle shadowJar plugin to v7.1.2. - Add mergeServiceFiles() to test chaincode shadowJar Gradle tasks to resolve an issue with incorrect class versions being loaded from dependencies. - Add ServicesResourceTransformer to test chaincode maven-shade-plugin Maven plugin configuration to resolve an issue with incorrect class versions being loaded from dependencies. - Tidy-up integration test contract dependencies Signed-off-by: Mark S. Lewis <Mark.S.Lewis@outlook.com>
1 parent 3b5b2cb commit 4d14529

File tree

39 files changed

+468
-341
lines changed

39 files changed

+468
-341
lines changed

‎dependency-suppression.xml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3+
<suppress>
4+
<notes><![CDATA[
5+
Core Fabric Go implementation vulnerability, not fabric-protos.
6+
]]></notes>
7+
<packageUrl regex="true">^pkg:maven/org\.hyperledger\.fabric/fabric\-protos@.*$</packageUrl>
8+
<cve>CVE-2022-31121</cve>
9+
</suppress>
10+
<suppress>
11+
<notes><![CDATA[
12+
Core Fabric Go implementation vulnerability, not fabric-protos.
13+
]]></notes>
14+
<packageUrl regex="true">^pkg:maven/org\.hyperledger\.fabric/fabric\-protos@.*$</packageUrl>
15+
<cve>CVE-2022-36023</cve>
16+
</suppress>
17+
<suppress>
18+
<notes><![CDATA[
19+
Vulnerability in C++ gRPC implementation.
20+
]]></notes>
21+
<packageUrl regex="true">^pkg:maven/io\.opentelemetry\.instrumentation/opentelemetry\-grpc\-1\.6@.*$</packageUrl>
22+
<cve>CVE-2023-33953</cve>
23+
</suppress>
24+
<suppress>
25+
<notes><![CDATA[
26+
Vulnerability in C++ gRPC implementation.
27+
]]></notes>
28+
<packageUrl regex="true">^pkg:maven/io\.opentelemetry\.instrumentation/opentelemetry\-grpc\-1\.6@.*$</packageUrl>
29+
<cve>CVE-2023-32732</cve>
30+
</suppress>
31+
<suppress>
32+
<notes><![CDATA[
33+
Vulnerability in hutool-json, which is not used.
34+
]]></notes>
35+
<packageUrl regex="true">^pkg:maven/org\.json/json@.*$</packageUrl>
36+
<cve>CVE-2022-45688</cve>
37+
</suppress>
38+
</suppressions>

‎examples/fabric-contract-example-as-service/build.gradle‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
plugins {
2-
id 'com.github.johnrengelman.shadow' version '2.0.3'
2+
id 'com.github.johnrengelman.shadow' version '7.1.2'
33
id 'java'
44
}
55

@@ -21,7 +21,7 @@ repositories {
2121

2222
dependencies {
2323
compile group: 'org.hyperledger.fabric-chaincode-java', name: 'fabric-chaincode-shim', version: '2.3.+'
24-
compile group: 'org.json', name: 'json', version: '20180813'
24+
compile 'org.json:json:20230618'
2525
testImplementation 'org.junit.jupiter:junit-jupiter:5.4.2'
2626
testImplementation 'org.assertj:assertj-core:3.11.1'
2727
testImplementation 'org.mockito:mockito-core:2.+'
@@ -31,6 +31,7 @@ shadowJar {
3131
baseName = 'chaincode'
3232
version = null
3333
classifier = null
34+
mergeServiceFiles()
3435

3536
manifest {
3637
attributes 'Main-Class': 'org.example.Application'

‎examples/fabric-contract-example-gradle-kotlin/build.gradle.kts‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import com.github.jengelman.gradle.plugins.shadow.tasks.ShadowJar
55

66

77
plugins {
8-
id("com.github.johnrengelman.shadow") version "5.2.0"
8+
id("com.github.johnrengelman.shadow") version "7.1.2"
99
id("org.jetbrains.kotlin.jvm") version "1.3.41"
1010
}
1111

@@ -20,7 +20,7 @@ java {
2020

2121
dependencies {
2222
implementation("org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.0")
23-
implementation("org.json:json:20180813")
23+
implementation("org.json:json:20230618")
2424
implementation("org.jetbrains.kotlin:kotlin-stdlib-jdk8")
2525

2626
testImplementation("org.junit.jupiter:junit-jupiter:5.4.2")
@@ -44,6 +44,7 @@ tasks {
4444
baseName = "chaincode"
4545
version = null
4646
classifier = null
47+
mergeServiceFiles()
4748
manifest {
4849
attributes(mapOf("Main-Class" to "org.hyperledger.fabric.contract.ContractRouter"))
4950
}

‎examples/fabric-contract-example-gradle/build.gradle‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
plugins {
2-
id 'com.github.johnrengelman.shadow' version '2.0.3'
2+
id 'com.github.johnrengelman.shadow' version '7.1.2'
33
id 'java'
44
}
55

@@ -21,7 +21,7 @@ repositories {
2121

2222
dependencies {
2323
compile group: 'org.hyperledger.fabric-chaincode-java', name: 'fabric-chaincode-shim', version: '2.5.0'
24-
compile group: 'org.json', name: 'json', version: '20180813'
24+
compile 'org.json:json:20230618'
2525
testImplementation 'org.junit.jupiter:junit-jupiter:5.4.2'
2626
testImplementation 'org.assertj:assertj-core:3.11.1'
2727
testImplementation 'org.mockito:mockito-core:2.+'
@@ -31,6 +31,7 @@ shadowJar {
3131
baseName = 'chaincode'
3232
version = null
3333
classifier = null
34+
mergeServiceFiles()
3435

3536
manifest {
3637
attributes 'Main-Class': 'org.hyperledger.fabric.contract.ContractRouter'

‎examples/ledger-api/build.gradle‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
plugins {
2-
id 'com.github.johnrengelman.shadow' version '2.0.3'
2+
id 'com.github.johnrengelman.shadow' version '7.1.2'
33
id 'java'
44
}
55

@@ -21,7 +21,7 @@ repositories {
2121

2222
dependencies {
2323
compile group: 'org.hyperledger.fabric-chaincode-java', name: 'fabric-chaincode-shim', version: '1.4.5'
24-
compile group: 'org.json', name: 'json', version: '20180813'
24+
compile 'org.json:json:20230618'
2525
testImplementation 'org.junit.jupiter:junit-jupiter:5.4.2'
2626
testImplementation 'org.assertj:assertj-core:3.11.1'
2727
testImplementation 'org.mockito:mockito-core:2.+'
@@ -31,6 +31,7 @@ shadowJar {
3131
baseName = 'chaincode'
3232
version = null
3333
classifier = null
34+
mergeServiceFiles()
3435

3536
manifest {
3637
attributes 'Main-Class': 'org.hyperledger.fabric.contract.ContractRouter'

‎fabric-chaincode-integration-test/build.gradle‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
dependencies {
22
implementation project(':fabric-chaincode-docker')
33
implementation project(':fabric-chaincode-shim')
4-
implementation group: 'org.json', name: 'json', version: '20180813'
4+
implementation 'org.json:json:20230618'
55
}
66

77

‎fabric-chaincode-integration-test/src/contracts/bare-gradle/build.gradle‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
plugins {
2-
id 'com.github.johnrengelman.shadow' version '5.1.0'
2+
id 'com.github.johnrengelman.shadow' version '7.1.2'
33
id 'java'
44
}
55

@@ -18,18 +18,15 @@ repositories {
1818
}
1919

2020
dependencies {
21-
implementation group: 'org.hyperledger.fabric-chaincode-java', name: 'fabric-chaincode-shim', version: '2.5.1'
22-
implementation group: 'org.hyperledger.fabric', name:'fabric-protos', version:'0.1.3'
23-
testImplementation group: 'junit', name: 'junit', version: '4.12'
24-
implementation group: 'commons-logging', name: 'commons-logging', version: '1.2'
25-
implementation group: 'com.google.code.gson', name: 'gson', version: '2.8.6'
26-
implementation group: 'com.google.protobuf', name: 'protobuf-java', version: '3.4.0'
21+
implementation'org.hyperledger.fabric-chaincode-java:fabric-chaincode-shim:2.5.1'
22+
implementation 'org.hyperledger.fabric:fabric-protos:0.2.+'
2723
}
2824

2925
shadowJar {
3026
baseName = 'chaincode'
3127
version = null
3228
classifier = null
29+
mergeServiceFiles()
3330

3431
manifest {
3532
attributes 'Main-Class': 'org.hyperledger.fabric.contract.ContractRouter'

‎fabric-chaincode-integration-test/src/contracts/bare-gradle/src/main/java/org/hyperledger/fabric/example/BareGradle.java‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,12 @@
55

66
import org.hyperledger.fabric.contract.Context;
77
import org.hyperledger.fabric.contract.ContractInterface;
8-
import org.hyperledger.fabric.contract.annotation.*;
9-
import org.hyperledger.fabric.metrics.Metrics;
10-
import org.hyperledger.fabric.metrics.MetricsProvider;
11-
import org.hyperledger.fabric.shim.ledger.*;
12-
import org.hyperledger.fabric.shim.*;
13-
14-
import java.util.*;
15-
import static java.nio.charset.StandardCharsets.UTF_8;
8+
import org.hyperledger.fabric.contract.annotation.Contact;
9+
import org.hyperledger.fabric.contract.annotation.Contract;
10+
import org.hyperledger.fabric.contract.annotation.Default;
11+
import org.hyperledger.fabric.contract.annotation.Info;
12+
import org.hyperledger.fabric.contract.annotation.License;
13+
import org.hyperledger.fabric.contract.annotation.Transaction;
1614

1715
@Contract(name = "BareGradle",
1816
info = @Info(title = "BareGradle contract",

‎fabric-chaincode-integration-test/src/contracts/bare-maven/pom.xml‎

Lines changed: 3 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,6 @@
1414
<!-- fabric-chaincode-java -->
1515
<fabric-chaincode-java.version>2.5.1</fabric-chaincode-java.version>
1616

17-
<!-- Logging -->
18-
<logback.version>1.2.0</logback.version>
19-
<slf4j.version>1.7.5</slf4j.version>
20-
21-
<!-- Test -->
22-
<junit.jupiter.version>5.3.0-RC1</junit.jupiter.version>
23-
<junit.platform.version>1.3.0-RC1</junit.platform.version>
24-
2517
</properties>
2618

2719
<repositories>
@@ -49,75 +41,13 @@
4941
<scope>compile</scope>
5042
</dependency>
5143

52-
<dependency>
53-
<groupId>org.hyperledger.fabric</groupId>
54-
<artifactId>fabric-protos</artifactId>
55-
<version>0.1.3</version>
56-
<scope>compile</scope>
57-
</dependency>
58-
59-
60-
<!-- fabric-sdk-java -->
61-
62-
<!-- Logging with SLF4J & LogBack -->
63-
<dependency>
64-
<groupId>org.slf4j</groupId>
65-
<artifactId>slf4j-api</artifactId>
66-
<version>${slf4j.version}</version>
67-
<scope>compile</scope>
68-
</dependency>
69-
<dependency>
70-
<groupId>ch.qos.logback</groupId>
71-
<artifactId>logback-classic</artifactId>
72-
<version>${logback.version}</version>
73-
<scope>runtime</scope>
74-
</dependency>
75-
76-
<!-- Test Artifacts -->
77-
<dependency>
78-
<groupId>org.junit.jupiter</groupId>
79-
<artifactId>junit-jupiter-api</artifactId>
80-
<version>${junit.jupiter.version}</version>
81-
<scope>compile</scope>
82-
</dependency>
83-
<dependency>
84-
<groupId>org.junit.jupiter</groupId>
85-
<artifactId>junit-jupiter-params</artifactId>
86-
<version>${junit.jupiter.version}</version>
87-
<scope>test</scope>
88-
</dependency>
89-
<dependency>
90-
<groupId>org.junit.jupiter</groupId>
91-
<artifactId>junit-jupiter-engine</artifactId>
92-
<version>${junit.jupiter.version}</version>
93-
<scope>test</scope>
94-
</dependency>
95-
<!-- https://mvnrepository.com/artifact/org.mockito/mockito-core -->
96-
<dependency>
97-
<groupId>org.mockito</groupId>
98-
<artifactId>mockito-core</artifactId>
99-
<version>2.10.0</version>
100-
</dependency>
101-
102-
<!-- https://mvnrepository.com/artifact/org.json/json -->
103-
<dependency>
104-
<groupId>org.json</groupId>
105-
<artifactId>json</artifactId>
106-
<version>20180813</version>
107-
</dependency>
108-
10944
</dependencies>
11045
<build>
11146
<sourceDirectory>src</sourceDirectory>
11247
<plugins>
113-
<!-- JUnit 5 requires Surefire version 2.22.0 or higher -->
114-
<plugin>
115-
<artifactId>maven-surefire-plugin</artifactId>
116-
<version>2.22.0</version>
117-
</plugin>
11848
<plugin>
11949
<artifactId>maven-compiler-plugin</artifactId>
120-
<version>3.1</version>
50+
<version>3.11.0</version>
12151
<configuration>
12252
<source>${java.version}</source>
12353
<target>${java.version}</target>
@@ -126,7 +56,7 @@
12656
<plugin>
12757
<groupId>org.apache.maven.plugins</groupId>
12858
<artifactId>maven-shade-plugin</artifactId>
129-
<version>3.1.0</version>
59+
<version>3.5.0</version>
13060
<executions>
13161
<execution>
13262
<phase>package</phase>
@@ -136,6 +66,7 @@
13666
<configuration>
13767
<finalName>chaincode</finalName>
13868
<transformers>
69+
<transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
13970
<transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
14071
<mainClass>org.hyperledger.fabric.contract.ContractRouter</mainClass>
14172
</transformer>
@@ -158,5 +89,4 @@
15889
</plugins>
15990
</build>
16091

161-
16292
</project>

‎fabric-chaincode-integration-test/src/contracts/bare-maven/src/main/java/org/hyperledger/fabric/example/BareMaven.java‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,12 @@
55

66
import org.hyperledger.fabric.contract.Context;
77
import org.hyperledger.fabric.contract.ContractInterface;
8-
import org.hyperledger.fabric.contract.annotation.*;
9-
import org.hyperledger.fabric.metrics.Metrics;
10-
import org.hyperledger.fabric.metrics.MetricsProvider;
11-
import org.hyperledger.fabric.shim.ledger.*;
12-
import org.hyperledger.fabric.shim.*;
13-
14-
import java.util.*;
15-
import static java.nio.charset.StandardCharsets.UTF_8;
8+
import org.hyperledger.fabric.contract.annotation.Contact;
9+
import org.hyperledger.fabric.contract.annotation.Contract;
10+
import org.hyperledger.fabric.contract.annotation.Default;
11+
import org.hyperledger.fabric.contract.annotation.Info;
12+
import org.hyperledger.fabric.contract.annotation.License;
13+
import org.hyperledger.fabric.contract.annotation.Transaction;
1614

1715
@Contract(name = "BareMaven",
1816
info = @Info(title = "BareGradle contract",

0 commit comments

Comments
 (0)