fix(cve): patch 5 CVEs in jackson/postgresql; wire up shiro & jline fork WIP - #39
Merged
Merged
Conversation
Applied fixes in this pass (rebuild + smoke test verified — Nexus 3.76.0-03 starts cleanly, all 10 smoke tests pass, HTTP 200 on 8081): - CVE-2026-54512 HIGH jackson-databind 2.17.0 -> 2.18.8 - CVE-2026-54513 HIGH jackson-databind 2.17.0 -> 2.18.8 - CVE-2026-54514 MED jackson-databind 2.17.0 -> 2.18.8 - CVE-2026-42198 MED postgresql 42.7.2 -> 42.7.11 To keep the Jackson OSGi wiring intact (databind imports com.fasterxml.jackson.annotation with range [2.18, 3.0)), also bump jackson-core to 2.18.8 and add a jackson-annotations 2.17.0 -> 2.18.8 replacement step. Exemptions added to .trivyignore: - CVE-2026-54515 MED jackson-databind — fix versions 2.18.9 / 2.21.5 are not yet released to Maven Central as of 2026-07-02; only 3.1.4 has the patch and is a major incompatible bump. Remove after 2.18.9 lands. - CVE-2026-23901 LOW shiro-core — already backported in the 1.13.1-alauda fork; Trivy still matches on version string < 2.1.0. Still open, tracked separately (fork PRs pending): - CVE-2026-49268 HIGH shiro-core LDAP — AlaudaDevops/shiro#3 - CVE-2026-43827 MED shiro-core session fixation — AlaudaDevops/shiro#3 - CVE-2026-43828 MED shiro-web secure cookie — AlaudaDevops/shiro#3 - CVE-2026-56740 HIGH jline telnet NEW-ENVIRON — AlaudaDevops/jline3#2 - CVE-2026-56741 HIGH jline telnet NAWS — AlaudaDevops/jline3#2 Once those fork releases publish, bump the TODO(sec) markers in Containerfile and add the corresponding shiro-web / org.jline.jline replace.sh steps.
Collaborator
Author
|
/build-testing-base-image |
dlcdn.apache.org rotates old Maven versions off the mirror (3.9.14 was removed after 3.9.16 became latest), which broke build-testing-base-image with curl exit 22 / HTTP 404. archive.apache.org keeps all historical versions permanently.
Collaborator
Author
|
/build-testing-base-image |
Collaborator
Author
|
/integration-test |
1 similar comment
Collaborator
Author
|
/integration-test |
2 tasks
Collaborator
Author
|
/integration-test |
Collaborator
Author
|
/test nexus-image |
…ases Now that AlaudaDevops/shiro#3 and AlaudaDevops/jline3#2 are merged and their release workflows have published: - shiro-core-1.13.2-alauda.jar - shiro-web-1.13.2-alauda.jar - jline-3.21.0-alauda.jar Wire the new jars into the image build so the following CVEs are actually patched at runtime: - CVE-2026-49268 (HIGH) shiro-core LDAP DN injection - CVE-2026-43827 (MEDIUM) shiro-core session fixation on login - CVE-2026-43828 (MEDIUM) shiro-web insecure session/rememberMe cookies - CVE-2026-56741 (HIGH) jline telnet NAWS DoS - CVE-2026-56740 (HIGH) jline telnet NEW-ENVIRON heap DoS Trivy version-matches by string, so the fork versions still trip its DB rules even with the fix applied. Extended .trivyignore with the five CVE/GHSA IDs (plus the pre-existing CVE-2026-23901) documenting the backport in each case. Local smoke test: Nexus starts cleanly, HTTP 200 on 8081, 10/10 smoke tests pass. Trivy re-scan: 0 findings above the ignore list.
Collaborator
Author
|
/build-image |
Collaborator
Author
|
/test nexus-image |
Collaborator
Author
|
/retest |
Collaborator
Author
|
/test-all |
Collaborator
Author
|
/build-image |
Collaborator
Author
|
/test nexus-image |
Manually built via PipelineRun nexus-image-manual-hqlrf on business-build cluster (PAC webhook relay gosmee was broken so bypassed it and directly created the PipelineRun). Image contains the shiro 1.13.2-alauda + jline 3.21.0-alauda fork jars that clear the remaining 5 CVEs. Digest: sha256:84c9c91edb0e4e9a82c0185ab29c0fadf3fbdbd4a0dcdd02cd16f271de8a245b
|
/help |
Collaborator
Author
✅ 手工触发的 build-image + integration-test 均通过
手工触发结果
自动触发失效的根因
排查步骤（供 devops 复现）# 1. 看该 PR 的最新事件是否进过 PAC
kubectl -n devops get repository nexus-build -o yaml | yq '.status.pipelinerun_status[-3:]'
# 2. 看 gosmee 是否卡住（最后一条日志时间戳应该在几分钟内）
kubectl -n pipelines-as-code logs deploy/gosmee --tail=3
# 3. 卡住就重启
kubectl -n pipelines-as-code rollout restart deploy/gosmeePR 状态代码修复、镜像构建、chart tag 更新、集成测试全部就绪。可以 merge。 🤖 Generated with Claude Code |
chengjingtao
approved these changes
Jul 6, 2026
Collaborator
Author
|
/ready |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Second-round CVE remediation for the 3.76.0-03 Nexus image. Rebuild + smoke tested locally (Nexus starts cleanly, 10/10 smoke tests pass, HTTP 200 on 8081).
Fixed in this PR (rebuild + smoke test verified)
To satisfy jackson-databind's OSGi Import-Package
[2.18, 3.0)constraint,jackson-coreis bumped 2.18.6 → 2.18.8 and a newjackson-annotations2.17.0 → 2.18.8 replace step is added.New .trivyignore exemptions
1.13.1-alaudafork; Trivy still matches by version string < 2.1.0.Still open — fork PRs pending
The following require an upstream JAR release before the Containerfile can pick them up. Fork PRs are already prepared:
Rationale for the fork route (documented in the PRs):
[1.13, 2.0)range)[3.21, 4)range)Once each fork PR merges + a tag is pushed, the release workflows I added produce
shiro-core-1.13.2-alauda.jar/shiro-web-1.13.2-alauda.jarandjline-3.21.0-alauda.jar. Follow-up PR will bump theTODO(sec)markers left in Containerfile.Test plan
./hack/build-nexus-image.sh --tag nexus-test:vul-partialsucceeds./hack/local-smoke-test.sh run --image nexus-test:vul-partialpasses 10/10./hack/scan-image.sh --image nexus-test:vul-partialconfirms the 4 fixed CVEs disappear from the report:8081/🤖 Generated with Claude Code