Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Libraries to fetch the updated netty patched with CVE-2022-24823 #230

Merged
merged 5 commits into from
Sep 15, 2022

Conversation

kiranprakash154
Copy link
Contributor

@kiranprakash154 kiranprakash154 commented Sep 14, 2022

Signed-off-by: Kiran Prakash awskiran@amazon.com

Is your feature request related to a problem? Please provide an existing Issue # , or describe.
netty had a CVE-2022-24823 that was patched in 4.1.77.Final

PA RCA uses netty via grpc which updated the netty to 4.1.77.Final in 1.49.0

For a green build - This is building off Performance Analyzer against my
fork - kiranprakash154/performance-analyzer
branch - kiranprakash154:kp/update-netty-json

Next Steps:

  1. Merge this PR
  2. Rebase the PR in Performance Analyzer & merge
  3. Create a followup PR here to revert the branch and repo to main and origin.

Describe the solution you are proposing
Update grpc version from 1.44.0 to 1.49.0

Check List

  • New functionality includes testing.
    • All tests pass
  • New functionality has been documented.
    • New functionality has javadoc added
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: Kiran Prakash <awskiran@amazon.com>
Signed-off-by: Kiran Prakash <awskiran@amazon.com>
@codecov-commenter
Copy link

codecov-commenter commented Sep 14, 2022

Codecov Report

Merging #230 (c9c07d0) into main (353455c) will decrease coverage by 0.08%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##               main     #230      +/-   ##
============================================
- Coverage     71.62%   71.53%   -0.09%     
  Complexity     2988     2988              
============================================
  Files           380      380              
  Lines         18952    18952              
  Branches       1463     1463              
============================================
- Hits          13574    13558      -16     
- Misses         4783     4799      +16     
  Partials        595      595              
Impacted Files Coverage Δ
...nalyzer/rca/net/handler/PublishRequestHandler.java 73.46% <0.00%> (-14.29%) ⬇️
...nceanalyzer/rca/samplers/MetricsDBFileSampler.java 75.00% <0.00%> (-9.10%) ⬇️
...nsearch/performanceanalyzer/rca/RcaController.java 81.05% <0.00%> (-1.77%) ⬇️
...erformanceanalyzer/rca/framework/core/RcaConf.java 55.94% <0.00%> (-1.40%) ⬇️
...ceanalyzer/rca/store/rca/hotshard/HotShardRca.java 87.12% <0.00%> (+0.99%) ⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

Signed-off-by: Kiran Prakash <awskiran@amazon.com>
Signed-off-by: Kiran Prakash <awskiran@amazon.com>
Signed-off-by: Kiran Prakash <awskiran@amazon.com>
@kiranprakash154 kiranprakash154 changed the title update netty version Update Libraries to fetch the updated netty patched with CVE-2022-24823 Sep 14, 2022
@kiranprakash154 kiranprakash154 marked this pull request as ready for review September 14, 2022 22:22
@kiranprakash154 kiranprakash154 requested a review from a team September 14, 2022 22:22
@sgup432
Copy link
Contributor

sgup432 commented Sep 15, 2022

Looks good to me. Will approve once you revert fork change.

@kiranprakash154 kiranprakash154 self-assigned this Sep 15, 2022
@opensearch-trigger-bot
Copy link

The backport to 1.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-1.x 1.x
# Navigate to the new working tree
cd .worktrees/backport-1.x
# Create a new branch
git switch --create backport/backport-230-to-1.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 93c22e74e04c1ba635af7941a41b011beb3d15bf
# Push it to GitHub
git push --set-upstream origin backport/backport-230-to-1.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-1.x

Then, create a pull request where the base branch is 1.x and the compare/head branch is backport/backport-230-to-1.x.

kiranprakash154 added a commit to kiranprakash154/performance-analyzer-rca that referenced this pull request Sep 16, 2022
… (opensearch-project#230)

* update netty version

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

* update netty version

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

* update branch to the one in PA to get a green build

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

* use the correct branch name

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

* use the correct branch name

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

Signed-off-by: Kiran Prakash <awskiran@amazon.com>
(cherry picked from commit 93c22e7)
kiranprakash154 added a commit to kiranprakash154/performance-analyzer-rca that referenced this pull request Sep 16, 2022
… (opensearch-project#230)

* update netty version

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

* update netty version

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

* update branch to the one in PA to get a green build

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

* use the correct branch name

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

* use the correct branch name

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

Signed-off-by: Kiran Prakash <awskiran@amazon.com>
(cherry picked from commit 93c22e7)
kiranprakash154 added a commit to kiranprakash154/performance-analyzer-rca that referenced this pull request Sep 16, 2022
… (opensearch-project#230)

* update netty version

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

* update netty version

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

* update branch to the one in PA to get a green build

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

* use the correct branch name

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

* use the correct branch name

Signed-off-by: Kiran Prakash <awskiran@amazon.com>

Signed-off-by: Kiran Prakash <awskiran@amazon.com>
(cherry picked from commit 93c22e7)
@opensearch-trigger-bot
Copy link

The backport to 2.3 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.3 2.3
# Navigate to the new working tree
cd .worktrees/backport-2.3
# Create a new branch
git switch --create backport/backport-230-to-2.3
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 93c22e74e04c1ba635af7941a41b011beb3d15bf
# Push it to GitHub
git push --set-upstream origin backport/backport-230-to-2.3
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.3

Then, create a pull request where the base branch is 2.3 and the compare/head branch is backport/backport-230-to-2.3.

@opensearch-trigger-bot
Copy link

The backport to 1.3 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-1.3 1.3
# Navigate to the new working tree
cd .worktrees/backport-1.3
# Create a new branch
git switch --create backport/backport-230-to-1.3
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 93c22e74e04c1ba635af7941a41b011beb3d15bf
# Push it to GitHub
git push --set-upstream origin backport/backport-230-to-1.3
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-1.3

Then, create a pull request where the base branch is 1.3 and the compare/head branch is backport/backport-230-to-1.3.

@opensearch-trigger-bot
Copy link

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.x 2.x
# Navigate to the new working tree
cd .worktrees/backport-2.x
# Create a new branch
git switch --create backport/backport-230-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 93c22e74e04c1ba635af7941a41b011beb3d15bf
# Push it to GitHub
git push --set-upstream origin backport/backport-230-to-2.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-230-to-2.x.

kiranprakash154 added a commit that referenced this pull request Sep 19, 2022
* Update Libraries to fetch the updated netty patched with CVE-2022-24823 (#230)

Signed-off-by: Kiran Prakash <awskiran@amazon.com>
(cherry picked from commit 93c22e7)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants