[BUG] CVEs in conda release

What happened:

Running Grype on DaskSQL.jar from the latest conda release (dask-sql=2022.1) returned 6 fixable CVEs

grype graphistry/graphistry-nvidia:v2.39.7-11.4 \
    --only-fixed \
    -o template \
    -t grype.friendly.tmpl

with template grype.friendly.tmpl

"Package","Version Installed","Vulnerability ID","Severity","Location",
{{- range .Matches}}
"{{.Artifact.Name}}","{{.Artifact.Version}}","{{.Vulnerability.ID}}","{{.Vulnerability.Severity}}","{{.Artifact.Locations}}"
{{- end}}

=>

...
jackson-databind","2.10.0","GHSA-57j2-w4cx-62h2","High","[Location<RealPath="/opt/conda/envs/rapids/lib/python3.8/site-packages/dask_sql/jar/DaskSQL.jar" Layer="sha256:5c80fa32eb12dd95d387ae9121c3a8ba9713207626bbc7b849613b4bb0eb3586">]"
"httpclient","4.5.9","GHSA-7r82-7xv7-xcpj","Medium","[Location<RealPath="/opt/conda/envs/rapids/lib/python3.8/site-packages/dask_sql/jar/DaskSQL.jar" Layer="sha256:5c80fa32eb12dd95d387ae9121c3a8ba9713207626bbc7b849613b4bb0eb3586">]"
"json-smart","2.3","GHSA-fg2v-w576-w4v3","High","[Location<RealPath="/opt/conda/envs/rapids/lib/python3.8/site-packages/dask_sql/jar/DaskSQL.jar" Layer="sha256:5c80fa32eb12dd95d387ae9121c3a8ba9713207626bbc7b849613b4bb0eb3586">]"
"commons-io","2.4","GHSA-gwrp-pvrq-jmwv","Medium","[Location<RealPath="/opt/conda/envs/rapids/lib/python3.8/site-packages/dask_sql/jar/DaskSQL.jar" Layer="sha256:5c80fa32eb12dd95d387ae9121c3a8ba9713207626bbc7b849613b4bb0eb3586">]"
"snakeyaml","1.24","GHSA-rvwf-54qp-4r6v","High","[Location<RealPath="/opt/conda/envs/rapids/lib/python3.8/site-packages/dask_sql/jar/DaskSQL.jar" Layer="sha256:5c80fa32eb12dd95d387ae9121c3a8ba9713207626bbc7b849613b4bb0eb3586">]"
"json-smart","2.3","GHSA-v528-7hrm-frqp","Critical","[Location<RealPath="/opt/conda/envs/rapids/lib/python3.8/site-packages/dask_sql/jar/DaskSQL.jar" Layer="sha256:5c80fa32eb12dd95d387ae9121c3a8ba9713207626bbc7b849613b4bb0eb3586">]

What you expected to happen:

The latest stable release should ideally have no fixable CVEs

Minimal Complete Verifiable Example:

See above

Anything else we need to know?:

Environment:

• dask-sql version: 2022.01
• Python version: Any
• Operating System: Any (Ubuntu container)
• Install method (conda, pip, source): Conda

[charlesbluca]

Turns out the httpclient CVE was easier to resolve than once thought 🙂 merged in https://github.com/dask-contrib/dask-sql/pull/453 and did patch release 2022.4.1 with the fix - on my end there are no longer any fixable CVEs detected by grype - @lmeyerov if you get a chance can you confirm?

[charlesbluca]

To give a general update on the ongoing work to resolve these CVEs:

• #445 has resolved the CVEs in json-smart, commons-io, and snakeyaml
• #449 should resolve the jackson-databind CVE
• still waiting on a new Calcite Avatica release to resolve the httpclient CVE, in the meantime we will disable our SQL server in #448 until that CVE can be resolved