From 85f3d56b43d752bc6822e4adb03af1e33cf4cab2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A0=20Manero?= Date: Fri, 16 Oct 2026 09:10:49 +0200 Subject: [PATCH 1/2] fix(deps): bump java-jwt to 4.6.2 and hibernate-validator to 8.0.6.Final --- openmetadata-integration-tests/pom.xml | 2 +- openmetadata-sdk/pom.xml | 2 +- openmetadata-service/pom.xml | 2 +- .../service/security/JwtFilterTest.java | 16 ++++++++++++++++ pom.xml | 2 +- 5 files changed, 20 insertions(+), 4 deletions(-) diff --git a/openmetadata-integration-tests/pom.xml b/openmetadata-integration-tests/pom.xml index 509f57d080eb..78fd642627c5 100644 --- a/openmetadata-integration-tests/pom.xml +++ b/openmetadata-integration-tests/pom.xml @@ -178,7 +178,7 @@ com.auth0 java-jwt - 4.4.0 + ${java-jwt.version} test diff --git a/openmetadata-sdk/pom.xml b/openmetadata-sdk/pom.xml index c778a014b04f..52aaccaa2ec2 100644 --- a/openmetadata-sdk/pom.xml +++ b/openmetadata-sdk/pom.xml @@ -22,7 +22,7 @@ 2.0.9 1.18.30 1.21.4 - 4.4.0 + 4.6.2 9.22.3 20240303 diff --git a/openmetadata-service/pom.xml b/openmetadata-service/pom.xml index 1d4c68038e52..0739dcb18dd3 100644 --- a/openmetadata-service/pom.xml +++ b/openmetadata-service/pom.xml @@ -83,7 +83,7 @@ org.hibernate.validator hibernate-validator - 8.0.1.Final + 8.0.6.Final diff --git a/openmetadata-service/src/test/java/org/openmetadata/service/security/JwtFilterTest.java b/openmetadata-service/src/test/java/org/openmetadata/service/security/JwtFilterTest.java index 848c5cff2a29..02c3b0d71f45 100644 --- a/openmetadata-service/src/test/java/org/openmetadata/service/security/JwtFilterTest.java +++ b/openmetadata-service/src/test/java/org/openmetadata/service/security/JwtFilterTest.java @@ -14,6 +14,7 @@ package org.openmetadata.service.security; import static java.lang.String.format; +import static java.nio.charset.StandardCharsets.UTF_8; import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertNull; import static org.junit.jupiter.api.Assertions.assertThrows; @@ -41,6 +42,7 @@ import java.security.interfaces.RSAPublicKey; import java.time.Instant; import java.time.temporal.ChronoUnit; +import java.util.Base64; import java.util.Date; import java.util.List; import java.util.Locale; @@ -238,6 +240,20 @@ void testInvalidToken() { exception.getMessage().toLowerCase(Locale.ROOT).contains("Invalid token.".toLowerCase())); } + @Test + void testOutOfRangeExpiryClaimIsAnInvalidToken() { + Base64.Encoder encoder = Base64.getUrlEncoder().withoutPadding(); + String header = encoder.encodeToString("{\"alg\":\"RS256\",\"typ\":\"JWT\"}".getBytes(UTF_8)); + String payload = + encoder.encodeToString("{\"sub\":\"sam\",\"exp\":9223372036854775807}".getBytes(UTF_8)); + ContainerRequestContext context = createRequestContextWithJwt(header + "." + payload + ".c2ln"); + + Exception exception = + assertThrows(AuthenticationException.class, () -> jwtFilter.filter(context)); + assertTrue( + exception.getMessage().toLowerCase(Locale.ROOT).contains("Invalid token.".toLowerCase())); + } + @Test void testExpiredToken() { String jwt = diff --git a/pom.xml b/pom.xml index 1a48f341bc6a..045503c7e142 100644 --- a/pom.xml +++ b/pom.xml @@ -159,7 +159,7 @@ 3.0.0 1.16.7 2.0.1 - 4.4.0 + 4.6.2 0.22.1 0.9.1 2.1.6 From dfacd4c4a60b3737ad416b21a7ee51c4344fb6bd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A0=20Manero?= Date: Fri, 16 Oct 2026 09:33:00 +0200 Subject: [PATCH 2/2] fix(security): bump guava to 33.7.2-jre, hibernate-validator to 8.0.6.Final, java-jwt to 4.6.2 (backport 2.0 #35291) --- openmetadata-k8s-operator/pom.xml | 2 +- openmetadata-service/pom.xml | 2 +- .../service/security/JwtFilterTest.java | 16 ---------------- pom.xml | 9 +++++++++ 4 files changed, 11 insertions(+), 18 deletions(-) diff --git a/openmetadata-k8s-operator/pom.xml b/openmetadata-k8s-operator/pom.xml index 227e8602e0a9..fbfb9ba9ce88 100644 --- a/openmetadata-k8s-operator/pom.xml +++ b/openmetadata-k8s-operator/pom.xml @@ -94,7 +94,7 @@ org.hibernate.validator hibernate-validator - 8.0.1.Final + 8.0.6.Final diff --git a/openmetadata-service/pom.xml b/openmetadata-service/pom.xml index 0739dcb18dd3..1a31b3d95932 100644 --- a/openmetadata-service/pom.xml +++ b/openmetadata-service/pom.xml @@ -871,7 +871,7 @@ com.google.guava guava - 33.7.2-jre + ${guava.version} compile diff --git a/openmetadata-service/src/test/java/org/openmetadata/service/security/JwtFilterTest.java b/openmetadata-service/src/test/java/org/openmetadata/service/security/JwtFilterTest.java index 02c3b0d71f45..848c5cff2a29 100644 --- a/openmetadata-service/src/test/java/org/openmetadata/service/security/JwtFilterTest.java +++ b/openmetadata-service/src/test/java/org/openmetadata/service/security/JwtFilterTest.java @@ -14,7 +14,6 @@ package org.openmetadata.service.security; import static java.lang.String.format; -import static java.nio.charset.StandardCharsets.UTF_8; import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertNull; import static org.junit.jupiter.api.Assertions.assertThrows; @@ -42,7 +41,6 @@ import java.security.interfaces.RSAPublicKey; import java.time.Instant; import java.time.temporal.ChronoUnit; -import java.util.Base64; import java.util.Date; import java.util.List; import java.util.Locale; @@ -240,20 +238,6 @@ void testInvalidToken() { exception.getMessage().toLowerCase(Locale.ROOT).contains("Invalid token.".toLowerCase())); } - @Test - void testOutOfRangeExpiryClaimIsAnInvalidToken() { - Base64.Encoder encoder = Base64.getUrlEncoder().withoutPadding(); - String header = encoder.encodeToString("{\"alg\":\"RS256\",\"typ\":\"JWT\"}".getBytes(UTF_8)); - String payload = - encoder.encodeToString("{\"sub\":\"sam\",\"exp\":9223372036854775807}".getBytes(UTF_8)); - ContainerRequestContext context = createRequestContextWithJwt(header + "." + payload + ".c2ln"); - - Exception exception = - assertThrows(AuthenticationException.class, () -> jwtFilter.filter(context)); - assertTrue( - exception.getMessage().toLowerCase(Locale.ROOT).contains("Invalid token.".toLowerCase())); - } - @Test void testExpiredToken() { String jwt = diff --git a/pom.xml b/pom.xml index 045503c7e142..ff2fb93c845b 100644 --- a/pom.xml +++ b/pom.xml @@ -145,6 +145,10 @@ own schedule; it is not a reason to leave a server on 5.6, which is still exposed to the CVE above. --> 6.2.0 + + 33.7.2-jre open-metadata_OpenMetadata ${project.artifactId} @@ -209,6 +213,11 @@ transitively from dropwizard-core and stay unmanaged on its older line (e.g. jetty-security, CVE-2026-10050 digest authentication bypass). Imported before anything that pulls dropwizard so the patched line wins. --> + + com.google.guava + guava + ${guava.version} + org.eclipse.jetty jetty-bom