From 44ca3057947602935c62bfbfd49324bb36c741e7 Mon Sep 17 00:00:00 2001 From: redcatbear Date: Tue, 20 Oct 2026 08:44:06 +0200 Subject: [PATCH 1/2] Updated `org.ow2.asm:*:9.11.1` to fix CVE-2026-112046. --- doc/changes/changelog.md | 1 + doc/changes/changes_0.6.22.md | 63 +++++++++++++++++++++++++++++++++++ pom.xml | 14 ++++---- 3 files changed, 71 insertions(+), 7 deletions(-) create mode 100644 doc/changes/changes_0.6.22.md diff --git a/doc/changes/changelog.md b/doc/changes/changelog.md index 88a79ff..19b22bb 100644 --- a/doc/changes/changelog.md +++ b/doc/changes/changelog.md @@ -1,5 +1,6 @@ # Changes +* [0.6.22](changes_0.6.22.md) * [0.6.21](changes_0.6.21.md) * [0.6.20](changes_0.6.20.md) * [0.6.19](changes_0.6.19.md) diff --git a/doc/changes/changes_0.6.22.md b/doc/changes/changes_0.6.22.md new file mode 100644 index 0000000..ba66714 --- /dev/null +++ b/doc/changes/changes_0.6.22.md @@ -0,0 +1,63 @@ +# Udf Debugging Java 0.6.22, released 2026-10-20 + +Code name: Fixed CVE-2026-112046 + +## Summary + +This release fixes the following vulnerabilities by pinning the version of transitive dependencies `org.ow2.asm:*:9.11.1`. + +This is necessary because there is no update for `org.jacoco.agent` available yet that includes these updates. + +First pin was in version 0.6.21. + +* In `org.ow2.asm:asm:jar:9.10.1`: + * CVE-2026-110257: Uncontrolled Memory Allocation (6.8) + * CVE-2026-110258: Uncontrolled Memory Allocation (6.8) + * CVE-2026-110259: Uncontrolled Recursion (5.5) + * CVE-2026-110260: Algorithmic Complexity (5.5) + * CVE-2026-110261: Algorithmic Complexity (6.8) + * CVE-2026-110263: Uncontrolled Recursion (6.8) +* In `org.ow2.asm:asm:jar:9.11`: + * CVE-2026-112046: Loop with Unreachable Exit Condition ('Infinite Loop') (5.5) +* In `org.ow2.asm:asm-commons:jar:9.10.1` + * CVE-2026-110262: Allocation of Resources Without Limits or Throttling (4.8) + * CVE-2026-110270: Algorithmic Complexity (5.5) + +## Features + +* Fixed CVEs in transitive dependency `org.ow2.asm:*` (PR# 91) + +## Dependency Updates + +### Compile Dependency Updates + +* Updated `com.exasol:bucketfs-java:4.0.0` to `5.0.1` +* Added `org.ow2.asm:asm-commons:9.11` +* Added `org.ow2.asm:asm-tree:9.11` +* Added `org.ow2.asm:asm:9.11` +* Updated `org.slf4j:slf4j-jdk14:2.0.18` to `2.0.20` + +### Test Dependency Updates + +* Updated `com.exasol:exasol-testcontainers:7.3.0` to `8.0.2` +* Updated `com.exasol:test-db-builder-java:4.0.1` to `4.0.3` +* Updated `org.mockito:mockito-junit-jupiter:5.23.0` to `5.24.0` + +### Plugin Dependency Updates + +* Updated `com.exasol:error-code-crawler-maven-plugin:2.1.0` to `2.1.2` +* Updated `com.exasol:project-keeper-maven-plugin:5.7.3` to `5.7.7` +* Updated `io.github.git-commit-id:git-commit-id-maven-plugin:10.0.0` to `10.0.1` +* Updated `org.apache.maven.plugins:maven-artifact-plugin:3.6.1` to `3.7.0` +* Updated `org.apache.maven.plugins:maven-compiler-plugin:3.15.0` to `3.16.0` +* Updated `org.apache.maven.plugins:maven-dependency-plugin:null` to `3.11.0` +* Updated `org.apache.maven.plugins:maven-deploy-plugin:3.1.4` to `3.2.0` +* Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.5.6` to `3.6.0` +* Updated `org.apache.maven.plugins:maven-install-plugin:3.1.4` to `3.2.0` +* Updated `org.apache.maven.plugins:maven-surefire-plugin:3.5.6` to `3.6.0` +* Updated `org.apache.maven.plugins:maven-toolchains-plugin:3.2.0` to `3.3.0` +* Updated `org.codehaus.mojo:build-helper-maven-plugin:3.6.1` to `3.6.2` +* Updated `org.codehaus.mojo:flatten-maven-plugin:1.7.3` to `1.8.0` +* Updated `org.codehaus.mojo:versions-maven-plugin:2.21.0` to `2.23.0` +* Updated `org.sonarsource.scanner.maven:sonar-maven-plugin:5.7.0.6970` to `5.8.0.7211` +* Updated `org.sonatype.central:central-publishing-maven-plugin:0.11.0` to `0.12.0` diff --git a/pom.xml b/pom.xml index 0914162..bab5d24 100644 --- a/pom.xml +++ b/pom.xml @@ -2,7 +2,7 @@ 4.0.0 udf-debugging-java - 0.6.21 + 0.6.22 udf-debugging-java Utilities for debugging, profiling and code coverage measure for UDFs. https://github.com/exasol/udf-debugging-java/ @@ -37,22 +37,22 @@ + CVE-2026-110263 from 9.10.1 and CVE-2026-112046 from 9.11 (org.jacoco.agent) --> org.ow2.asm asm - 9.11 + 9.11.1 - + org.ow2.asm asm-commons - 9.11 + 9.11.1 - + org.ow2.asm asm-tree - 9.11 + 9.11.1 com.exasol From 8f033285bd56cc6c2e54b89281e03c9d43d288b1 Mon Sep 17 00:00:00 2001 From: redcatbear Date: Tue, 20 Oct 2026 08:47:23 +0200 Subject: [PATCH 2/2] #93: Updated changelog. --- doc/changes/changes_0.6.22.md | 33 +++------------------------------ pk_generated_parent.pom | 2 +- pom.xml | 2 +- 3 files changed, 5 insertions(+), 32 deletions(-) diff --git a/doc/changes/changes_0.6.22.md b/doc/changes/changes_0.6.22.md index ba66714..dbcbeb6 100644 --- a/doc/changes/changes_0.6.22.md +++ b/doc/changes/changes_0.6.22.md @@ -31,33 +31,6 @@ First pin was in version 0.6.21. ### Compile Dependency Updates -* Updated `com.exasol:bucketfs-java:4.0.0` to `5.0.1` -* Added `org.ow2.asm:asm-commons:9.11` -* Added `org.ow2.asm:asm-tree:9.11` -* Added `org.ow2.asm:asm:9.11` -* Updated `org.slf4j:slf4j-jdk14:2.0.18` to `2.0.20` - -### Test Dependency Updates - -* Updated `com.exasol:exasol-testcontainers:7.3.0` to `8.0.2` -* Updated `com.exasol:test-db-builder-java:4.0.1` to `4.0.3` -* Updated `org.mockito:mockito-junit-jupiter:5.23.0` to `5.24.0` - -### Plugin Dependency Updates - -* Updated `com.exasol:error-code-crawler-maven-plugin:2.1.0` to `2.1.2` -* Updated `com.exasol:project-keeper-maven-plugin:5.7.3` to `5.7.7` -* Updated `io.github.git-commit-id:git-commit-id-maven-plugin:10.0.0` to `10.0.1` -* Updated `org.apache.maven.plugins:maven-artifact-plugin:3.6.1` to `3.7.0` -* Updated `org.apache.maven.plugins:maven-compiler-plugin:3.15.0` to `3.16.0` -* Updated `org.apache.maven.plugins:maven-dependency-plugin:null` to `3.11.0` -* Updated `org.apache.maven.plugins:maven-deploy-plugin:3.1.4` to `3.2.0` -* Updated `org.apache.maven.plugins:maven-failsafe-plugin:3.5.6` to `3.6.0` -* Updated `org.apache.maven.plugins:maven-install-plugin:3.1.4` to `3.2.0` -* Updated `org.apache.maven.plugins:maven-surefire-plugin:3.5.6` to `3.6.0` -* Updated `org.apache.maven.plugins:maven-toolchains-plugin:3.2.0` to `3.3.0` -* Updated `org.codehaus.mojo:build-helper-maven-plugin:3.6.1` to `3.6.2` -* Updated `org.codehaus.mojo:flatten-maven-plugin:1.7.3` to `1.8.0` -* Updated `org.codehaus.mojo:versions-maven-plugin:2.21.0` to `2.23.0` -* Updated `org.sonarsource.scanner.maven:sonar-maven-plugin:5.7.0.6970` to `5.8.0.7211` -* Updated `org.sonatype.central:central-publishing-maven-plugin:0.11.0` to `0.12.0` +* Updated `org.ow2.asm:asm-commons:9.11` to `9.11.1` +* Updated `org.ow2.asm:asm-tree:9.11` to `9.11.1` +* Updated `org.ow2.asm:asm:9.11` to `9.11.1` diff --git a/pk_generated_parent.pom b/pk_generated_parent.pom index 08fe9a7..73373d1 100644 --- a/pk_generated_parent.pom +++ b/pk_generated_parent.pom @@ -3,7 +3,7 @@ 4.0.0 com.exasol udf-debugging-java-generated-parent - 0.6.21 + 0.6.22 pom UTF-8 diff --git a/pom.xml b/pom.xml index bab5d24..f926b1a 100644 --- a/pom.xml +++ b/pom.xml @@ -164,7 +164,7 @@ udf-debugging-java-generated-parent com.exasol - 0.6.21 + 0.6.22 pk_generated_parent.pom