Repository: provectus/kafka-ui
Issue: CVEs fixes, October 22
Labels: good first issue
scope/backend
type/security
status/accepted

https://github.com/provectus/kafka-ui/actions/runs/3058781951/jobs/4935377778
Bump snakeyaml deps

Issue comments:
Can I work on this and raise a PR ?
Hey, sure.
@royca If you don't mind I would like to work on this since there has been no PR or any discussion for 12 days
@Haarolean please assign to me this issue if it possible
A fix for
CVE-2022-31690
CVE-2022-31692
New dependency [unavailable yet](https://github.com/spring-projects/spring-security/issues/12131), waiting for a spring boot 2.7.6.

Fixes for:
CVE-2022-3171
CVE-2022-36944
GHSA-h4h5-3hr4-j3g2
are unavailable yet, blame/wait for confluent

Snake yaml CVEs:
CVE-2022-25857  
CVE-2022-38749 
CVE-2022-38750 
CVE-2022-38751 
 CVE-2022-38752   

are [false positives](https://github.com/spring-projects/spring-boot/issues/32221).

Others have been fixed within #2926
@Haarolean I could see snakeyaml CVEs are false positive. Is it? I could see the issues created 

Here is an example 
https://bitbucket.org/snakeyaml/snakeyaml/issues/525 and they have been resolved.

So, is it possible to provide snakeyaml version 1.33 in 2.7.x version?
@Subrhamanya yes they are according to [this thread](https://github.com/spring-projects/spring-boot/issues/32221).
Anyway, we've bumped some dependencies once again and now we have a newer transitive snakeyaml version.
Does that mean 2.7.6 version of spring-boot will have snakeyaml version 1.33?
> Does that mean 2.7.6 version of spring-boot will have snakeyaml version 1.33?

AFAIK, yes.

Pull request review comments:
any specific reason we're downgrading?
@Haarolean Outdated local `master` branch. 🤦 

I've updated the PR.
@joschi any idea how did this thing get in here? There's no scala library prior to your commit 🤔 
@Haarolean Kafka (`org.apache.kafka:kafka_2.13` used in `kafka-ui-e2e-checks`) is written in Scala and was pulling in a vulnerable version.

This property is only used in dependency management, so that Maven will pull in the non-vulnerable version of the Scala standard library instead.

https://github.com/personio/kafka-ui/blob/2104d81e139bb6b489594dc10caf676ea725dcf9/pom.xml#L132-L136
@joschi thank you very much, I prefer to indicate this in poms, I'll add the comment

Patch that resolved the issue:
diff --git a/kafka-ui-api/pom.xml b/kafka-ui-api/pom.xml
index f9fa40386fb..95c64071dc5 100644
--- a/kafka-ui-api/pom.xml
+++ b/kafka-ui-api/pom.xml
@@ -20,18 +20,6 @@
         <sonar.language>java</sonar.language>
     </properties>
 
-    <dependencyManagement>
-        <dependencies>
-            <dependency>
-                <groupId>org.springframework.boot</groupId>
-                <artifactId>spring-boot-dependencies</artifactId>
-                <version>${spring-boot.version}</version>
-                <type>pom</type>
-                <scope>import</scope>
-            </dependency>
-        </dependencies>
-    </dependencyManagement>
-
     <dependencies>
         <dependency>
             <groupId>org.springframework.boot</groupId>
@@ -103,7 +91,7 @@
         <dependency>
             <groupId>software.amazon.msk</groupId>
             <artifactId>aws-msk-iam-auth</artifactId>
-            <version>1.1.3</version>
+            <version>1.1.5</version>
         </dependency>
 
         <dependency>
@@ -140,25 +128,21 @@
         <dependency>
             <groupId>org.testcontainers</groupId>
             <artifactId>testcontainers</artifactId>
-            <version>${test.containers.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.testcontainers</groupId>
             <artifactId>kafka</artifactId>
-            <version>${test.containers.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.testcontainers</groupId>
             <artifactId>junit-jupiter</artifactId>
-            <version>${test.containers.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.junit.jupiter</groupId>
             <artifactId>junit-jupiter-engine</artifactId>
-            <version>${junit-jupiter-engine.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>
diff --git a/kafka-ui-contract/pom.xml b/kafka-ui-contract/pom.xml
index 7f0863ed3b5..3c898b4fcf4 100644
--- a/kafka-ui-contract/pom.xml
+++ b/kafka-ui-contract/pom.xml
@@ -21,12 +21,10 @@
                 <dependency>
                     <groupId>org.springframework.boot</groupId>
                     <artifactId>spring-boot-starter-webflux</artifactId>
-                    <version>${spring-boot.version}</version>
                 </dependency>
                 <dependency>
                     <groupId>org.springframework.boot</groupId>
                     <artifactId>spring-boot-starter-validation</artifactId>
-                    <version>${spring-boot.version}</version>
                 </dependency>
                 <dependency>
                     <groupId>io.swagger</groupId>
diff --git a/kafka-ui-e2e-checks/pom.xml b/kafka-ui-e2e-checks/pom.xml
index 54a41c56ca3..12a702a76a5 100644
--- a/kafka-ui-e2e-checks/pom.xml
+++ b/kafka-ui-e2e-checks/pom.xml
@@ -12,27 +12,22 @@
     <artifactId>kafka-ui-e2e-checks</artifactId>
     <properties>
         <kafka-ui-contract>${project.version}</kafka-ui-contract>
-        <junit.version>5.8.2</junit.version>
         <aspectj.version>1.9.8</aspectj.version>
         <allure.version>2.18.1</allure.version>
         <json-smart.version>2.4.8</json-smart.version>
-        <testcontainers.version>1.17.2</testcontainers.version>
         <selenide.version>6.6.3</selenide.version>
         <assertj.version>3.23.1</assertj.version>
         <google.auto-service.version>1.0.1</google.auto-service.version>
         <hamcrest.version>2.2</hamcrest.version>
         <slf4j.version>1.7.36</slf4j.version>
-        <testcontainers.junit-jupiter.version>1.17.2</testcontainers.junit-jupiter.version>
         <allure.java-commons.version>2.18.1</allure.java-commons.version>
         <dotenv.version>2.2.4</dotenv.version>
-        <junit.platform-launcher.version>1.8.2</junit.platform-launcher.version>
         <allure.maven-plugin.version>2.6</allure.maven-plugin.version>
         <ashot.version>1.5.4</ashot.version>
         <allure.screendiff-plugin.version>2.18.1</allure.screendiff-plugin.version>
         <maven.surefire-plugin.version>2.22.2</maven.surefire-plugin.version>
         <allure-maven.version>2.10.0</allure-maven.version>
-        <kafka.version>3.0.0</kafka.version>
-        <netty.version>4.1.84.Final</netty.version>
+        <kafka.version>3.3.1</kafka.version>
         <qase.io.version>2.1.3</qase.io.version>
     </properties>
 
@@ -89,54 +84,44 @@
         <dependency>
             <groupId>io.netty</groupId>
             <artifactId>netty-buffer</artifactId>
-            <version>${netty.version}</version>
         </dependency>
         <dependency>
             <groupId>io.netty</groupId>
             <artifactId>netty-common</artifactId>
-            <version>${netty.version}</version>
         </dependency>
         <dependency>
             <groupId>io.netty</groupId>
             <artifactId>netty-codec</artifactId>
-            <version>${netty.version}</version>
         </dependency>
         <dependency>
             <groupId>io.netty</groupId>
             <artifactId>netty-handler</artifactId>
-            <version>${netty.version}</version>
         </dependency>
         <dependency>
             <groupId>io.netty</groupId>
             <artifactId>netty-resolver</artifactId>
-            <version>${netty.version}</version>
         </dependency>
         <dependency>
             <groupId>io.netty</groupId>
             <artifactId>netty-transport</artifactId>
-            <version>${netty.version}</version>
         </dependency>
         <dependency>
             <groupId>io.netty</groupId>
             <artifactId>netty-transport-native-epoll</artifactId>
-            <version>${netty.version}</version>
         </dependency>
         <dependency>
             <groupId>io.netty</groupId>
             <artifactId>netty-transport-native-unix-common</artifactId>
-            <version>${netty.version}</version>
         </dependency>
         <dependency>
             <groupId>io.netty</groupId>
             <artifactId>netty-resolver-dns-native-macos</artifactId>
-            <version>${netty.version}</version>
             <classifier>osx-aarch_64</classifier>
         </dependency>
 
         <dependency>
             <groupId>org.testcontainers</groupId>
             <artifactId>testcontainers</artifactId>
-            <version>${testcontainers.version}</version>
         </dependency>
 
         <dependency>
@@ -199,7 +184,6 @@
         <dependency>
             <groupId>org.testcontainers</groupId>
             <artifactId>junit-jupiter</artifactId>
-            <version>${testcontainers.junit-jupiter.version}</version>
         </dependency>
         <dependency>
             <groupId>io.qameta.allure</groupId>
@@ -214,7 +198,6 @@
         <dependency>
             <groupId>org.junit.platform</groupId>
             <artifactId>junit-platform-launcher</artifactId>
-            <version>${junit.platform-launcher.version}</version>
         </dependency>
         <dependency>
             <groupId>ru.yandex.qatools.allure</groupId>
@@ -245,7 +228,6 @@
         <dependency>
             <groupId>org.testcontainers</groupId>
             <artifactId>selenium</artifactId>
-            <version>${testcontainers.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>
diff --git a/kafka-ui-serde-api/pom.xml b/kafka-ui-serde-api/pom.xml
index 3b2b9f55fa9..b9aca207e58 100644
--- a/kafka-ui-serde-api/pom.xml
+++ b/kafka-ui-serde-api/pom.xml
@@ -13,10 +13,12 @@
     <build>
         <plugins>
             <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-install-plugin</artifactId>
                 <version>2.5.2</version>
             </plugin>
             <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-jar-plugin</artifactId>
                 <version>3.0.2</version>
             </plugin>
diff --git a/pom.xml b/pom.xml
index ecb707e1da0..32bb407fff0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -14,41 +14,54 @@
         <maven.compiler.release>17</maven.compiler.release>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
-        <spring-boot.version>2.7.5</spring-boot.version>
-        <jackson-databind-nullable.version>0.2.2</jackson-databind-nullable.version>
-        <org.mapstruct.version>1.4.2.Final</org.mapstruct.version>
-        <org.projectlombok.version>1.18.20</org.projectlombok.version>
-        <org.projectlombok.e2e-checks.version>1.18.20</org.projectlombok.e2e-checks.version>
+        <frontend-generated-sources-directory>..//kafka-ui-react-app/src/generated-sources
+        </frontend-generated-sources-directory>
+        <sonar.organization>provectus</sonar.organization>
+        <sonar.host.url>https://sonarcloud.io</sonar.host.url>
         <git.revision>latest</git.revision>
-        <kafka-clients.version>3.2.0</kafka-clients.version>
+
+        <!-- Dependency versions -->
+        <antlr4-maven-plugin.version>4.7.1</antlr4-maven-plugin.version>
+        <apache.commons.version>2.11.1</apache.commons.version>
+        <assertj.version>3.19.0</assertj.version>
+        <avro.version>1.11.1</avro.version>
+        <byte-buddy.version>1.12.18</byte-buddy.version>
+        <confluent.version>7.3.0</confluent.version>
+        <datasketches-java.version>3.1.0</datasketches-java.version>
+        <groovy.version>3.0.13</groovy.version>
+        <jackson-databind-nullable.version>0.2.4</jackson-databind-nullable.version>
+        <jackson.version>2.14.0</jackson.version>
+        <kafka-clients.version>3.3.1</kafka-clients.version>
+        <netty.version>4.1.85.Final</netty.version>
+        <org.mapstruct.version>1.4.2.Final</org.mapstruct.version>
+        <org.projectlombok.version>1.18.24</org.projectlombok.version>
+        <protobuf-java.version>3.21.9</protobuf-java.version>
+        <reactor-netty.version>1.1.0</reactor-netty.version>
+        <scala-lang.library.version>2.13.9</scala-lang.library.version>
+        <snakeyaml.version>1.33</snakeyaml.version>
+        <spring-boot.version>2.7.5</spring-boot.version>
+        <spring-security.version>5.7.5</spring-security.version>
+
+        <!-- Test dependency versions -->
+        <junit.version>5.9.1</junit.version>
+        <mockito.version>4.8.1</mockito.version>
+        <okhttp3.mockwebserver.version>4.10.0</okhttp3.mockwebserver.version>
+        <testcontainers.version>1.17.5</testcontainers.version>
+
+        <!-- Frontend dependency versions -->
         <node.version>v16.15.0</node.version>
         <pnpm.version>v7.4.0</pnpm.version>
+
+        <!-- Plugin versions -->
         <fabric8-maven-plugin.version>0.40.2</fabric8-maven-plugin.version>
         <frontend-maven-plugin.version>1.12.1</frontend-maven-plugin.version>
-        <maven-compiler-plugin.version>3.10.1</maven-compiler-plugin.version>
         <maven-clean-plugin.version>3.2.0</maven-clean-plugin.version>
+        <maven-compiler-plugin.version>3.10.1</maven-compiler-plugin.version>
         <maven-resources-plugin.version>3.2.0</maven-resources-plugin.version>
         <maven-surefire-plugin.version>2.22.2</maven-surefire-plugin.version>
         <openapi-generator-maven-plugin.version>4.3.0</openapi-generator-maven-plugin.version>
-        <swagger-annotations.version>1.6.0</swagger-annotations.version>
         <springdoc-openapi-webflux-ui.version>1.2.32</springdoc-openapi-webflux-ui.version>
-        <avro.version>1.11.0</avro.version>
-        <confluent.version>7.3.0</confluent.version>
-        <apache.commons.version>2.11.1</apache.commons.version>
-        <test.containers.version>1.17.1</test.containers.version>
-        <okhttp3.mockwebserver.version>4.10.0</okhttp3.mockwebserver.version>
-        <junit-jupiter-engine.version>5.7.2</junit-jupiter-engine.version>
-        <mockito.version>4.8.1</mockito.version>
-        <byte-buddy.version>1.12.18</byte-buddy.version>
-        <assertj.version>3.19.0</assertj.version>
-        <antlr4-maven-plugin.version>4.7.1</antlr4-maven-plugin.version>
-        <groovy.version>3.0.13</groovy.version>
-        <datasketches-java.version>3.1.0</datasketches-java.version>
-
-        <frontend-generated-sources-directory>..//kafka-ui-react-app/src/generated-sources
-        </frontend-generated-sources-directory>
-        <sonar.organization>provectus</sonar.organization>
-        <sonar.host.url>https://sonarcloud.io</sonar.host.url>
+        <swagger-annotations.version>1.6.0</swagger-annotations.version>
     </properties>
 
     <repositories>
@@ -86,6 +99,73 @@
         </pluginRepository>
     </pluginRepositories>
 
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-dependencies</artifactId>
+                <version>${spring-boot.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.springframework.security</groupId>
+                <artifactId>spring-security-bom</artifactId>
+                <version>${spring-security.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-bom</artifactId>
+                <version>${netty.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+            <dependency>
+                <groupId>com.fasterxml.jackson</groupId>
+                <artifactId>jackson-bom</artifactId>
+                <version>${jackson.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.scala-lang</groupId>
+                <artifactId>scala-library</artifactId>
+                <version>${scala-lang.library.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.yaml</groupId>
+                <artifactId>snakeyaml</artifactId>
+                <version>${snakeyaml.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>com.google.protobuf</groupId>
+                <artifactId>protobuf-java</artifactId>
+                <version>${protobuf-java.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>io.projectreactor.netty</groupId>
+                <artifactId>reactor-netty-http</artifactId>
+                <version>${reactor-netty.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.junit</groupId>
+                <artifactId>junit-bom</artifactId>
+                <version>${junit.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+            <dependency>
+                <groupId>org.testcontainers</groupId>
+                <artifactId>testcontainers-bom</artifactId>
+                <version>${testcontainers.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <build>
         <pluginManagement>
             <plugins>


Test patch: