[incubator-kie-issues#1571] Fix CVE-2024-8391

apache · Oct 28, 2024 · bb3bcc0 · bb3bcc0
1 parent 79b771a
commit bb3bcc0
Show file tree

Hide file tree

Showing 3 changed files with 57 additions and 1 deletion.
diff --git a/kogito-build/kogito-dependencies-bom/pom.xml b/kogito-build/kogito-dependencies-bom/pom.xml
@@ -90,7 +90,7 @@
 
     <version.io.smallrye.reactive.mutiny-vertx-web-client>3.11.0</version.io.smallrye.reactive.mutiny-vertx-web-client>
 
-    <version.io.vertx>4.5.7</version.io.vertx>
+    <version.io.vertx>4.5.10</version.io.vertx>
     <version.io.grpc>1.59.1</version.io.grpc>
 
     <version.io.quarkus.camel>3.9.0</version.io.quarkus.camel> <!-- TODO: quarkus version mismatch -->
@@ -882,6 +882,22 @@
         <artifactId>jep</artifactId>
         <version>${version.black.ninia}</version>
       </dependency>
+
+      <dependency>
+        <groupId>io.vertx</groupId>
+        <artifactId>vertx-grpc-server</artifactId>
+        <version>${version.io.vertx}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.vertx</groupId>
+        <artifactId>vertx-grpc-client</artifactId>
+        <version>${version.io.vertx}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.vertx</groupId>
+        <artifactId>vertx-grpc-common</artifactId>
+        <version>${version.io.vertx}</version>
+      </dependency>
     </dependencies>
   </dependencyManagement>
 

diff --git a/quarkus/addons/monitoring/prometheus/runtime/pom.xml b/quarkus/addons/monitoring/prometheus/runtime/pom.xml
@@ -45,8 +45,30 @@
      <dependency>
       <groupId>io.quarkus</groupId>
       <artifactId>quarkus-grpc</artifactId>
+       <exclusions>
+         <exclusion>
+           <groupId>io.vertx</groupId>
+           <artifactId>vertx-grpc-server</artifactId>
+         </exclusion>
+         <exclusion>
+           <groupId>io.vertx</groupId>
+           <artifactId>vertx-grpc-client</artifactId>
+         </exclusion>
+       </exclusions>
       <scope>runtime</scope>
     </dependency>
+    <dependency>
+      <groupId>io.vertx</groupId>
+      <artifactId>vertx-grpc-server</artifactId>
+      <scope>runtime</scope>
+    </dependency>
+    <dependency>
+      <groupId>io.vertx</groupId>
+      <artifactId>vertx-grpc-client</artifactId>
+      <scope>runtime</scope>
+    </dependency>
+
+
     <dependency>
       <groupId>io.quarkus</groupId>
       <artifactId>quarkus-micrometer-registry-prometheus</artifactId>

diff --git a/...s/kogito-quarkus-serverless-workflow-extension/kogito-quarkus-serverless-workflow/pom.xml b/...s/kogito-quarkus-serverless-workflow-extension/kogito-quarkus-serverless-workflow/pom.xml
@@ -73,6 +73,24 @@
     <dependency>
       <groupId>io.quarkus</groupId>
       <artifactId>quarkus-grpc</artifactId>
+      <exclusions>
+        <exclusion>
+            <groupId>io.vertx</groupId>
+            <artifactId>vertx-grpc-server</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>io.vertx</groupId>
+          <artifactId>vertx-grpc-client</artifactId>
+        </exclusion>
+      </exclusions>
+    </dependency>
+    <dependency>
+      <groupId>io.vertx</groupId>
+      <artifactId>vertx-grpc-server</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>io.vertx</groupId>
+      <artifactId>vertx-grpc-client</artifactId>
     </dependency>
 
     <!-- Support CloudEvents OotB -->