From 22513b8beb6e4a73bbeab2546a1203e4ab7eafd7 Mon Sep 17 00:00:00 2001 From: Forrest Evans Date: Thu, 11 Sep 2025 15:41:16 -0300 Subject: [PATCH 1/3] RUN-3601: Fix CVE-2025-48924 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2025-48924 (commons-lang3) - FIXED: No longer appears in the scan ✅ Commons-compress infinite loop vulnerability - FIXED: No longer appears in the scan The only remaining vulnerabilities are low-severity Information Exposure issues in Kotlin stdlib through okhttp3 dependencies, which are much less critical. What we accomplished: Added version variables to libs.versions.toml: commonsCompress = "1.26.0" commonsLang3 = "3.18.0" Added library definitions for both dependencies Implemented dependency resolution strategy in build.gradle using the version catalog variables: Forces commons-compress to 1.26.0 (fixes infinite loop vulnerability) Forces commons-lang3 to 3.18.0 (fixes CVE-2025-48924) Verified the fixes work through: Dependency tree showing version overrides Snyk scan confirming vulnerabilities are resolved --- build.gradle | 9 +++++++++ gradle/libs.versions.toml | 5 +++++ 2 files changed, 14 insertions(+) diff --git a/build.gradle b/build.gradle index e482e6e9..c860d618 100644 --- a/build.gradle +++ b/build.gradle @@ -45,6 +45,15 @@ subprojects{ options.addBooleanOption('html5', true) } } + + // Security fix: Force commons-compress to fixed version to address SNYK-JAVA-ORGAPACHECOMMONS-6254296 + // Security fix: Force commons-lang3 to fixed version to address CVE-2025-48924 + configurations.all { + resolutionStrategy { + force "org.apache.commons:commons-compress:${libs.versions.commonsCompress.get()}" + force "org.apache.commons:commons-lang3:${libs.versions.commonsLang3.get()}" + } + } } /** diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 999f17d6..044ce941 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -19,6 +19,8 @@ snakeYaml = "2.0" #used for authz lib integration rundeck = "4.17.6-20240402" testcontainers = "1.21.3" +commonsCompress = "1.26.0" +commonsLang3 = "3.18.0" [libraries] @@ -50,6 +52,9 @@ rundeckAuthzYaml = { module = "org.rundeck:rundeck-authz-yaml", version.ref = "r testcontainers = { module = "org.testcontainers:testcontainers", version.ref = "testcontainers" } testcontainersSpock = { module = "org.testcontainers:spock", version.ref = "testcontainers" } +commonsCompress = { module = "org.apache.commons:commons-compress", version.ref = "commonsCompress" } +commonsLang3 = { module = "org.apache.commons:commons-lang3", version.ref = "commonsLang3" } + [bundles] retrofit = ["retrofitCore", "retrofitJackson", "retrofitJaxb", "okhttpLogging", "okhttpUrlconnection", "jaxb"] From eb037cb250b51cf0bd1dfb5259be2d86b912b19c Mon Sep 17 00:00:00 2001 From: Forrest Evans Date: Thu, 11 Sep 2025 16:03:34 -0300 Subject: [PATCH 2/3] Fix builds for RUN-3601 --- build.gradle | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/build.gradle b/build.gradle index c860d618..c443855e 100644 --- a/build.gradle +++ b/build.gradle @@ -46,14 +46,22 @@ subprojects{ } } - // Security fix: Force commons-compress to fixed version to address SNYK-JAVA-ORGAPACHECOMMONS-6254296 // Security fix: Force commons-lang3 to fixed version to address CVE-2025-48924 + // Add dependency constraints for security fixes configurations.all { resolutionStrategy { - force "org.apache.commons:commons-compress:${libs.versions.commonsCompress.get()}" force "org.apache.commons:commons-lang3:${libs.versions.commonsLang3.get()}" } } + + dependencies { + constraints { + // Security fix: Ensure commons-compress is 1.26.0 to address SNYK-JAVA-ORGAPACHECOMMONS-6254296 + implementation("org.apache.commons:commons-compress:${libs.versions.commonsCompress.get()}") { + because("CVE fix for infinite loop vulnerability") + } + } + } } /** From 7c47a086e356c07f4b0d82d17728921f7c2bc416 Mon Sep 17 00:00:00 2001 From: Forrest Evans Date: Thu, 11 Sep 2025 16:09:57 -0300 Subject: [PATCH 3/3] Adjust to fix build errors --- build.gradle | 10 ---------- integration-tests/build.gradle | 2 ++ 2 files changed, 2 insertions(+), 10 deletions(-) diff --git a/build.gradle b/build.gradle index c443855e..86be0605 100644 --- a/build.gradle +++ b/build.gradle @@ -47,21 +47,11 @@ subprojects{ } // Security fix: Force commons-lang3 to fixed version to address CVE-2025-48924 - // Add dependency constraints for security fixes configurations.all { resolutionStrategy { force "org.apache.commons:commons-lang3:${libs.versions.commonsLang3.get()}" } } - - dependencies { - constraints { - // Security fix: Ensure commons-compress is 1.26.0 to address SNYK-JAVA-ORGAPACHECOMMONS-6254296 - implementation("org.apache.commons:commons-compress:${libs.versions.commonsCompress.get()}") { - because("CVE fix for infinite loop vulnerability") - } - } - } } /** diff --git a/integration-tests/build.gradle b/integration-tests/build.gradle index 48cafcbd..fee88061 100644 --- a/integration-tests/build.gradle +++ b/integration-tests/build.gradle @@ -11,6 +11,8 @@ dependencies { testImplementation libs.bundles.retrofit testImplementation libs.bundles.test testImplementation libs.bundles.testcontainers + // Security fix: Explicitly add fixed commons-compress version to override transitive dependency + testImplementation libs.commonsCompress } test { //note: this is intentionally commented out