[CVE Fix] Fixes CVE-2022-42920 by forcing bcel version to resovle to 6.6

[DarshitChanpura]

• Category: Bug fix

Issues Resolved

Resolves #2248

Check List

- [ ] New functionality includes testing
- [ ] New functionality has been documented

• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[codecov-commenter]

Codecov Report

Merging #2275 (15b0b40) into main (7cad5e4) will decrease coverage by 0.06%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##               main    #2275      +/-   ##
============================================
- Coverage     61.05%   60.99%   -0.07%     
+ Complexity     3270     3264       -6     
============================================
  Files           259      259              
  Lines         18337    18337              
  Branches       3248     3248              
============================================
- Hits          11196    11184      -12     
- Misses         5555     5563       +8     
- Partials       1586     1590       +4     

Impacted Files	Coverage Δ
...urity/ssl/transport/SecuritySSLNettyTransport.java	62.36% <0.00%> (-4.31%)	⬇️
...earch/security/ssl/util/SSLConnectionTestUtil.java	93.18% <0.00%> (-2.28%)	⬇️
...ecurity/configuration/ConfigurationRepository.java	72.13% <0.00%> (-2.19%)	⬇️
.../dlic/auth/ldap2/LDAPConnectionFactoryFactory.java	57.46% <0.00%> (-1.50%)	⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[cwperks]

Is there any way to track when a new spotbugs gradle plugin is release? https://plugins.gradle.org/plugin/com.github.spotbugs

In this discussion with the maintainer of spotbugs I see that 4.7.4 has not been released yet and 4.7.4 contains an update for bcel from 6.5.0 -> 6.6.1: spotbugs/spotbugs#2251

Once 4.7.4 is released the gradle plugin also needs to follow-up with a release.

[DarshitChanpura]

Is there any way to track when a new spotbugs gradle plugin is release? https://plugins.gradle.org/plugin/com.github.spotbugs

In this discussion with the maintainer of spotbugs I see that 4.7.4 has not been released yet and 4.7.4 contains an update for bcel from 6.5.0 -> 6.6.1: spotbugs/spotbugs#2251

Once 4.7.4 is released the gradle plugin also needs to follow-up with a release.

I'm not sure about the way to track the release automatically but I will keep an eye out for 4.7.4, and will update our build.gradle once it is out.

[opensearch-trigger-bot]

The backport to 2.4 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.4 2.4
# Navigate to the new working tree
cd .worktrees/backport-2.4
# Create a new branch
git switch --create backport/backport-2275-to-2.4
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 cad7c7201e902aeb711b407648d41d3c55fe7a49
# Push it to GitHub
git push --set-upstream origin backport/backport-2275-to-2.4
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.4

Then, create a pull request where the base branch is 2.4 and the compare/head branch is backport/backport-2275-to-2.4.

[opensearch-trigger-bot]

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.x 2.x
# Navigate to the new working tree
cd .worktrees/backport-2.x
# Create a new branch
git switch --create backport/backport-2275-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 cad7c7201e902aeb711b407648d41d3c55fe7a49
# Push it to GitHub
git push --set-upstream origin backport/backport-2275-to-2.x
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-2275-to-2.x.