-
Bug
-
Resolution: Unresolved
-
Minor
-
None
I was scanning all our Jenkins plugins using JFrog Xray and found that the Performance Plugin has a dependency on HyperSQL Database (HSQLDB). This dependency includes two Java classes (java.sql.Statement and java.sql.PreparedStatement) which are vulnerable to the critical vulnerability CVE-2022-41853.
As per the security ticket raised here: SECURITY-3436, your team has confirmed that these classes (java.sql.Statement and java.sql.PreparedStatement) from HSQLDB are not used in this plugin as a transitive dependency of the net.sf.ucanaccess library. Could you please confirm this?
However, I noticed that the JAR file hsqldb-2.5.0.jar is present in the plugin code, which may contain these classes (java.sql.Statement and java.sql.PreparedStatement).
Could you please consider updating the HSQLDB JAR to the latest version or at least version 2.7.1?
For more information, please refer to the Jira ticket here: SECURITY-3436.
[JENKINS-73532] Outdated HSQLDB Dependency in Jenkins performance plugin
markewaite Any updates on verifying whether the update to a transitive dependency has affected the functionality of the primary dependency?
gopi_22100 there is no update.
I've not done any additional work on this issue and I don't intend to do any additional work on this issue. I'm not a maintainer of the performance plugin. As far as I can tell, my earlier comments still apply. This is not a vulnerability in the performance plugin.
Scanners may complain that there is a vulnerable version in the plugin, but those scanners are wrong if they claim that there is a vulnerability in the plugin due to the vulnerable version of the library in the plugin. The solution is for scanner users to record in their scanner that the issue being reported is not a vulnerability.
If your organization is concerned that the dependency update needs to be performed, then you're welcome to submit a pull request proposing that update.
gopi_22100, security issues are only visible to specific people on issues.jenkins.io. The maintainers of the performance plugin won't be able to see the comments on that issue. I've copied the text that I wrote in that issue into this comment.
Plugin maintainers are encouraged to update dependencies, but in this case, the dependency to be updated is a transitive dependency of the net.sf.ucanaccess library. Updating a transitive dependency usually requires additional verification that the update has not broken the functionality of the primary dependency.
I reduced the priority of this request from critical to minor because the analysis shows that the plugin is not vulnerable to CVE-2022-41853.