Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Backport 2.x] Upgraded software.amazon.awssdk from 2.25.40 to 2.29.12 to address CVE… #3333

Conversation

rithin-pullela-aws
Copy link
Contributor

…… (#3320)

  • Upgraded software.amazon.awssdk from 2.25.40 to 2.29.0 to address CVE-2024-47535

  • Upgrading to 2.29.12 to upgrade netty-common library to 4.1.115

Backport for #3320

Description

[Describe what this change achieves]

Related Issues

Resolves #[Issue number to be closed when this PR is merged]

Check List

  • New functionality includes testing.
  • New functionality has been documented.
  • API changes companion pull request created.
  • Commits are signed per the DCO using --signoff.
  • Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

opensearch-project#3320)

* Upgraded software.amazon.awssdk from 2.25.40 to 2.29.0 to address CVE-2024-47535

Signed-off-by: rithin-pullela-aws <rithinp@amazon.com>

* Upgrading to 2.29.12 to upgrade netty-common library to 4.1.115

Signed-off-by: rithin-pullela-aws <rithinp@amazon.com>

---------

Signed-off-by: rithin-pullela-aws <rithinp@amazon.com>
@rithin-pullela-aws rithin-pullela-aws temporarily deployed to ml-commons-cicd-env-require-approval January 6, 2025 19:28 — with GitHub Actions Inactive
@rithin-pullela-aws rithin-pullela-aws temporarily deployed to ml-commons-cicd-env-require-approval January 6, 2025 19:28 — with GitHub Actions Inactive
@rithin-pullela-aws rithin-pullela-aws temporarily deployed to ml-commons-cicd-env-require-approval January 6, 2025 19:28 — with GitHub Actions Inactive
@rithin-pullela-aws rithin-pullela-aws temporarily deployed to ml-commons-cicd-env-require-approval January 6, 2025 19:28 — with GitHub Actions Inactive
@rithin-pullela-aws rithin-pullela-aws temporarily deployed to ml-commons-cicd-env-require-approval January 6, 2025 19:29 — with GitHub Actions Inactive
@rithin-pullela-aws rithin-pullela-aws temporarily deployed to ml-commons-cicd-env-require-approval January 6, 2025 19:29 — with GitHub Actions Inactive
@mingshl
Copy link
Collaborator

mingshl commented Jan 6, 2025

flaky bwc failed due to connection

=== Standard output of node `node{:opensearch-ml-plugin:mlCommonsBwcCluster0-2}` ===


»    ↓ errors and warnings from /home/runner/work/ml-commons/ml-commons/plugin/build/testclusters/mlCommonsBwcCluster0-2/logs/opensearch.stdout.log ↓
» WARN ][o.o.g.DanglingIndicesState] [mlCommonsBwcCluster0-2] gateway.auto_import_dangling_indices is disabled, dangling indices will not be automatically detected or imported and must be managed manually
» WARN ][o.o.d.FileBasedSeedHostsProvider] [mlCommonsBwcCluster0-2] expected, but did not find, a dynamic hosts list at [/home/runner/work/ml-commons/ml-commons/plugin/build/testclusters/mlCommonsBwcCluster0-2/config/unicast_hosts.txt]
» WARN ][o.o.c.NodeConnectionsService] [mlCommonsBwcCluster0-2] failed to connect to {mlCommonsBwcCluster0-1}{U6o-i5MaQHOdyKzrXblD8w}{glbWjz2ZTZ-40ZNTYQqNHw}{127.0.0.1}{127.0.0.1:37727}{dimr}{testattr=test, shard_indexing_pressure_enabled=true} (tried [1] times)
»  org.opensearch.transport.ConnectTransportException: [mlCommonsBwcCluster0-1][127.0.0.1:37727] connect_exception
»  	at org.opensearch.transport.TcpTransport$ChannelsConnectedListener.onFailure(TcpTransport.java:1076) ~[opensearch-2.4.0.jar:2.4.0]
»  	at org.opensearch.action.ActionListener.lambda$toBiConsumer$2(ActionListener.java:215) ~[opensearch-2.4.0.jar:2.4.0]
»  	at org.opensearch.common.concurrent.CompletableContext.lambda$addListener$0(CompletableContext.java:55) ~[opensearch-core-2.4.0.jar:2.4.0]
»  	at java.util.concurrent.CompletableFuture.uniWhenComplete(CompletableFuture.java:863) ~[?:?]
»  	at java.util.concurrent.CompletableFuture$UniWhenComplete.tryFire(CompletableFuture.java:841) ~[?:?]
»  	at java.util.concurrent.CompletableFuture.postComplete(CompletableFuture.java:510) ~[?:?]
»  	at java.util.concurrent.CompletableFuture.completeExceptionally(CompletableFuture.java:2162) ~[?:?]
»  	at org.opensearch.common.concurrent.CompletableContext.completeExceptionally(CompletableContext.java:70) ~[opensearch-core-2.4.0.jar:2.4.0]
»  	at org.opensearch.transport.netty4.Netty4TcpChannel.lambda$addListener$0(Netty4TcpChannel.java:81) ~[?:?]
»  	at io.netty.util.concurrent.DefaultPromise.notifyListener0(DefaultPromise.java:578) ~[?:?]
»  	at io.netty.util.concurrent.DefaultPromise.notifyListeners0(DefaultPromise.java:571) ~[?:?]
»  	at io.netty.util.concurrent.DefaultPromise.notifyListenersNow(DefaultPromise.java:550) ~[?:?]
»  	at io.netty.util.concurrent.DefaultPromise.notifyListeners(DefaultPromise.java:491) ~[?:?]
»  	at io.netty.util.concurrent.DefaultPromise.setValue0(DefaultPromise.java:616) ~[?:?]
»  	at io.netty.util.concurrent.DefaultPromise.setFailure0(DefaultPromise.java:609) ~[?:?]
»  	at io.netty.util.concurrent.DefaultPromise.tryFailure(DefaultPromise.java:117) ~[?:?]
»  	at io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.fulfillConnectPromise(AbstractNioChannel.java:321) ~[?:?]
»  	at io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.finishConnect(AbstractNioChannel.java:337) ~[?:?]
»  	at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:776) ~[?:?]
»  	at io.netty.channel.nio.NioEventLoop.processSelectedKeysPlain(NioEventLoop.java:689) ~[?:?]
»  	at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:652) ~[?:?]
»  	at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:562) ~[?:?]
»  	at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:997) ~[?:?]
»  	at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) ~[?:?]
»  	at java.lang.Thread.run(Thread.java:833) [?:?]
»  Caused by: io.netty.channel.AbstractChannel$AnnotatedConnectException: Connection refused: 127.0.0.1/127.0.0.1:37727
»  Caused by: java.net.ConnectException: Connection refused
»  	at sun.nio.ch.Net.pollConnect(Native Method) ~[?:?]
»  	at sun.nio.ch.Net.pollConnectNow(Net.java:672) ~[?:?]
»  	at sun.nio.ch.SocketChannelImpl.finishConnect(SocketChannelImpl.java:946) ~[?:?]
»  	at io.netty.channel.socket.nio.NioSocketChannel.doFinishConnect(NioSocketChannel.java:337) ~[?:?]
»  	at io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe.finishConnect(AbstractNioChannel.java:334) ~[?:?]
»  	... 7 more
»   ↓ last 40 non error or warning messages from /home/runner/work/ml-commons/ml-commons/plugin/build/testclusters/mlCommonsBwcCluster0-2/logs/opensearch.stdout.log ↓

@mingshl mingshl mentioned this pull request Jan 6, 2025
@rithin-pullela-aws rithin-pullela-aws temporarily deployed to ml-commons-cicd-env-require-approval January 6, 2025 21:11 — with GitHub Actions Inactive
@rithin-pullela-aws rithin-pullela-aws temporarily deployed to ml-commons-cicd-env-require-approval January 6, 2025 21:11 — with GitHub Actions Inactive
@rithin-pullela-aws rithin-pullela-aws temporarily deployed to ml-commons-cicd-env-require-approval January 6, 2025 21:11 — with GitHub Actions Inactive
@ylwu-amzn
Copy link
Collaborator

Can you check why Mend Security Check still failing?

@rithin-pullela-aws
Copy link
Contributor Author

Can you check why Mend Security Check still failing?

It is failing because of org.eclipse.core.runtime-3.26.100.jar . This has been addressed in this PR: #3313

@dhrubo-os
Copy link
Collaborator

Can you check why Mend Security Check still failing?

It is failing because of org.eclipse.core.runtime-3.26.100.jar . This has been addressed in this PR: #3313

Can we try to look at the issue in this backport PR: #3326 ?

@mingshl mingshl merged commit 225ca40 into opensearch-project:2.x Jan 8, 2025
14 of 15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants