Fix CVE-2025-58057 #4338

nathaliellenaa · 2025-10-22T22:53:10Z

Description

Fix CVE-2025-58057

Force netty-codec to 4.1.125.Final

for project in opensearch-ml-algorithms opensearch-ml-client opensearch-ml-common opensearch-ml-memory opensearch-ml-plugin opensearch-ml-search-processors opensearch-ml-spi; do
  echo "=== $project ==="
  ./gradlew :$project:dependencies | grep netty-codec
done
=== opensearch-ml-algorithms ===
|    +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final
|    |         \--- io.netty:netty-codec:4.1.125.Final (*)
|    +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
|    |         +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |         |    +--- io.netty:netty-codec:4.1.125.Final
|    |         |         \--- io.netty:netty-codec:4.1.125.Final (*)
|    |         +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |         |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |         |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    |         +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
|    +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final
|    |         \--- io.netty:netty-codec:4.1.125.Final (*)
|    +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
|         +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|         |    +--- io.netty:netty-codec:4.1.125.Final
|         |         \--- io.netty:netty-codec:4.1.125.Final (*)
|         +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|         |    +--- io.netty:netty-codec:4.1.125.Final (*)
|         |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|         +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
=== opensearch-ml-client ===
=== opensearch-ml-common ===
|    +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final
|    |         \--- io.netty:netty-codec:4.1.125.Final (*)
|    +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
|    +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final
|    |         \--- io.netty:netty-codec:4.1.125.Final (*)
|    +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
|    +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final
|    |         \--- io.netty:netty-codec:4.1.125.Final (*)
|    +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
=== opensearch-ml-memory ===
=== opensearch-ml-plugin ===
|    |    |         +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |    |         |    +--- io.netty:netty-codec:4.1.125.Final
|    |    |         +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |    |         |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |    |         |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    |    |         +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
|    |    |         +--- io.netty:netty-codec-http:4.1.124.Final -> 4.1.125.Final
|    |    |         |    +--- io.netty:netty-codec:4.1.125.Final
|    |    |         +--- io.netty:netty-codec-http2:4.1.124.Final -> 4.1.125.Final
|    |    |         |    +--- io.netty:netty-codec:4.1.125.Final (*)
|    |    |         |    \--- io.netty:netty-codec-http:4.1.125.Final (*)
|    |    |         +--- io.netty:netty-codec:4.1.124.Final -> 4.1.125.Final (*)
=== opensearch-ml-search-processors ===
=== opensearch-ml-spi ===

Couldn't find dependency insight for netty-codec-compression

for project in opensearch-ml-algorithms opensearch-ml-client opensearch-ml-common opensearch-ml-memory opensearch-ml-plugin opensearch-ml-search-processors opensearch-ml-spi; do
  echo "=== $project ==="
  ./gradlew :$project:dependencies | grep netty-codec-compression
done

=== opensearch-ml-algorithms ===
=== opensearch-ml-client ===
=== opensearch-ml-common ===
=== opensearch-ml-memory ===
=== opensearch-ml-plugin ===
=== opensearch-ml-search-processors ===
=== opensearch-ml-spi ===

Related Issues

Resolves #[Issue number to be closed when this PR is merged]

Check List

New functionality includes testing.
New functionality has been documented.
API changes companion pull request created.
Commits are signed per the DCO using --signoff.
Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

brianf-aws · 2025-10-23T00:06:01Z

Nice helper script ;)

You can make the changes on the root of the build file like this

7c49706

which will iterate over the subprojects opensearch-ml-algorithms opensearch-ml-client opensearch-ml-common opensearch-ml-memory opensearch-ml-plugin opensearch-ml-search-processors opensearch-ml-spi

That way we dont have to wackamole the build file in each subproject

nathaliellenaa · 2025-10-23T00:17:39Z

Nice helper script ;)

You can make the changes on the root of the build file like this

7c49706

which will iterate over the subprojects opensearch-ml-algorithms opensearch-ml-client opensearch-ml-common opensearch-ml-memory opensearch-ml-plugin opensearch-ml-search-processors opensearch-ml-spi

That way we dont have to wackamole the build file in each subproject

Good suggestion! I will apply this

dhrubo-os · 2025-10-23T00:38:06Z

build.gradle

        // Force spotless depending on newer version of guava due to CVE-2023-2976. Remove after spotless upgrades.
        resolutionStrategy.force "com.google.guava:guava:32.1.3-jre"
        resolutionStrategy.force 'org.apache.commons:commons-compress:1.26.0'
+        resolutionStrategy.force 'io.netty:netty-buffer:4.1.125.Final'


Are we really using all these?

We need to include those netty modules, otherwise the build will fail

Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com>

* fix cve Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> * Force version for other netty modules Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> * Apply suggestion Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> * Use versions.netty Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> --------- Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> (cherry picked from commit eec7179)

* fix cve * Force version for other netty modules * Apply suggestion * Use versions.netty --------- (cherry picked from commit eec7179) Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com> Co-authored-by: Nathalie Jonathan <143617992+nathaliellenaa@users.noreply.github.com>

nathaliellenaa requested review from HenryL27, Zhangxunmt, austintlee, b4sjoo, dhrubo-os, jngz-es, mingshl, model-collapse, pyek-bot, rbhavna, sam-herman, xinyual, ylwu-amzn and zane-neo as code owners October 22, 2025 22:53

nathaliellenaa had a problem deploying to ml-commons-cicd-env-require-approval October 22, 2025 22:55 — with GitHub Actions Failure

nathaliellenaa had a problem deploying to ml-commons-cicd-env-require-approval October 22, 2025 22:55 — with GitHub Actions Error

nathaliellenaa had a problem deploying to ml-commons-cicd-env-require-approval October 22, 2025 22:55 — with GitHub Actions Failure

nathaliellenaa requested a deployment to ml-commons-cicd-env-require-approval October 22, 2025 23:57 — with GitHub Actions Waiting

nathaliellenaa temporarily deployed to ml-commons-cicd-env-require-approval October 23, 2025 00:23 — with GitHub Actions Inactive

brianf-aws approved these changes Oct 23, 2025

View reviewed changes

dhrubo-os reviewed Oct 23, 2025

View reviewed changes

pyek-bot approved these changes Oct 23, 2025

View reviewed changes

peterzhuamazon added the backport 3.3 label Oct 23, 2025

peterzhuamazon mentioned this pull request Oct 23, 2025

[RELEASE] Release version 3.3.2 opensearch-project/opensearch-build#5799

Closed

65 tasks

nathaliellenaa had a problem deploying to ml-commons-cicd-env-require-approval October 23, 2025 17:41 — with GitHub Actions Failure

nathaliellenaa had a problem deploying to ml-commons-cicd-env-require-approval October 23, 2025 17:41 — with GitHub Actions Error

nathaliellenaa requested a deployment to ml-commons-cicd-env-require-approval October 23, 2025 21:39 — with GitHub Actions Waiting

nathaliellenaa added 4 commits October 23, 2025 14:47

fix cve

241f0c5

Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com>

Force version for other netty modules

801daf5

Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com>

Apply suggestion

ac7a429

Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com>

Use versions.netty

1753f60

Signed-off-by: Nathalie Jonathan <nathhjo@amazon.com>

nathaliellenaa force-pushed the CVE-2025-58057 branch from 6d97145 to 1753f60 Compare October 23, 2025 21:47

nathaliellenaa temporarily deployed to ml-commons-cicd-env-require-approval October 23, 2025 21:49 — with GitHub Actions Inactive

brianf-aws mentioned this pull request Oct 23, 2025

Fix agent type update #4341

Open

5 tasks

jiapingzeng approved these changes Oct 23, 2025

View reviewed changes

peterzhuamazon mentioned this pull request Oct 23, 2025

[AUTO] Increment version to 3.3.2-SNAPSHOT opensearch-project/neural-search#1629

Merged

dhrubo-os approved these changes Oct 23, 2025

View reviewed changes

nathaliellenaa had a problem deploying to ml-commons-cicd-env-require-approval October 23, 2025 23:02 — with GitHub Actions Failure

nathaliellenaa had a problem deploying to ml-commons-cicd-env-require-approval October 23, 2025 23:02 — with GitHub Actions Error

dhrubo-os merged commit eec7179 into opensearch-project:main Oct 23, 2025
10 of 13 checks passed

opensearch-trigger-bot bot mentioned this pull request Oct 23, 2025

[Backport 3.3] Fix CVE-2025-58057 #4343

Merged

brianf-aws mentioned this pull request Oct 24, 2025

address CVE-2025-58057 opensearch-project/opensearch-remote-metadata-sdk#276

Closed

peterzhuamazon mentioned this pull request Nov 5, 2025

Bump gradle to 9.2.0 and JDK to 25 in non-publishing GHAs opensearch-project/opensearch-protobufs#276

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix CVE-2025-58057 #4338

Fix CVE-2025-58057 #4338

Uh oh!

nathaliellenaa commented Oct 22, 2025 •

edited by peterzhuamazon

Loading

Uh oh!

brianf-aws commented Oct 23, 2025

Uh oh!

nathaliellenaa commented Oct 23, 2025

Uh oh!

dhrubo-os Oct 23, 2025

Uh oh!

nathaliellenaa Oct 23, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Fix CVE-2025-58057 #4338

Fix CVE-2025-58057 #4338

Uh oh!

Conversation

nathaliellenaa commented Oct 22, 2025 • edited by peterzhuamazon Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issues

Check List

Uh oh!

brianf-aws commented Oct 23, 2025

Uh oh!

nathaliellenaa commented Oct 23, 2025

Uh oh!

dhrubo-os Oct 23, 2025

Choose a reason for hiding this comment

Uh oh!

nathaliellenaa Oct 23, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

nathaliellenaa commented Oct 22, 2025 •

edited by peterzhuamazon

Loading