CVE fixes (#378)

* PK fix

* Upgrade dependencies

* Ready to release

Author: Shmuma

.github/workflows/ci-build.yml

@@ -0,0 +1,37 @@
+# Cloud Storage Extension 2.9.4, released 2026-04-01
+
+Code name: Update dependencies to fix CVEs
+
+## Summary
+
+This release updates the project dependencies to fix the following cves:
+- CVE-2025-33042: org.apache.avro:avro:jar:1.12.0:compile
+- CVE-2026-24308: org.apache.zookeeper:zookeeper:jar:3.9.4:compile
+- CVE-2026-24281: org.apache.zookeeper:zookeeper:jar:3.9.4:compile
+- CVE-2026-33871: io.netty:netty-codec-http2:jar:4.2.9.Final:compile
+- CVE-2026-33870: io.netty:netty-codec-http:jar:4.2.9.Final:compile
+
+## Security
+
+* #369: CVE-2025-33042: org.apache.avro:avro:jar:1.12.0:compile
+* #371: CVE-2026-24308: org.apache.zookeeper:zookeeper:jar:3.9.4:compile
+* #373: CVE-2026-24281: org.apache.zookeeper:zookeeper:jar:3.9.4:compile
+* #375: CVE-2026-33871: io.netty:netty-codec-http2:jar:4.2.9.Final:compile
+* #376: CVE-2026-33870: io.netty:netty-codec-http:jar:4.2.9.Final:compile
+
+## Dependency Updates
+
+### Cloud Storage Extension
+
+#### Compile Dependency Updates
+
+* Updated `org.apache.avro:avro:1.12.0` to `1.12.1`
+* Updated `org.apache.orc:orc-core:1.9.7` to `1.9.8`
+* Updated `org.apache.zookeeper:zookeeper:3.9.4` to `3.9.5`
+
+#### Plugin Dependency Updates
+
+* Updated `com.exasol:error-code-crawler-maven-plugin:2.0.5` to `2.0.6`
+* Updated `com.exasol:project-keeper-maven-plugin:5.4.5` to `5.4.6`
+* Updated `org.apache.maven.plugins:maven-compiler-plugin:3.14.1` to `3.15.0`
+* Updated `org.codehaus.mojo:versions-maven-plugin:2.20.1` to `2.21.0`

doc/changes/changelog.md

@@ -150,7 +150,7 @@ downloaded jar file is the same as the checksum provided in the releases.
 To check the SHA256 result of the local jar, run the command:
 
 ```sh
-sha256sum exasol-cloud-storage-extension-2.9.3.jar
+sha256sum exasol-cloud-storage-extension-2.9.4.jar
 ```
 
 ### Building From Source
@@ -180,7 +180,7 @@ mvn clean package -DskipTests=true
 ```
 
 The assembled jar file should be located at
-`target/exasol-cloud-storage-extension-2.9.3.jar`.
+`target/exasol-cloud-storage-extension-2.9.4.jar`.
 
 ### Create an Exasol Bucket
 
@@ -202,7 +202,7 @@ for the HTTP protocol.
 Upload the jar file using curl command:
 
 ```sh
-curl -X PUT -T exasol-cloud-storage-extension-2.9.3.jar \
+curl -X PUT -T exasol-cloud-storage-extension-2.9.4.jar \
   http://w:<WRITE_PASSWORD>@exasol.datanode.domain.com:2580/<BUCKET>/
 ```
 
@@ -237,7 +237,7 @@ OPEN SCHEMA CLOUD_STORAGE_EXTENSION;
 
 CREATE OR REPLACE JAVA SET SCRIPT IMPORT_PATH(...) EMITS (...) AS
   %scriptclass com.exasol.cloudetl.scriptclasses.FilesImportQueryGenerator;
-  %jar /buckets/bfsdefault/<BUCKET>/exasol-cloud-storage-extension-2.9.3.jar;
+  %jar /buckets/bfsdefault/<BUCKET>/exasol-cloud-storage-extension-2.9.4.jar;
 /
 
 CREATE OR REPLACE JAVA SCALAR SCRIPT IMPORT_METADATA(...) EMITS (
@@ -247,12 +247,12 @@ CREATE OR REPLACE JAVA SCALAR SCRIPT IMPORT_METADATA(...) EMITS (
   end_index DECIMAL(36, 0)
 ) AS
   %scriptclass com.exasol.cloudetl.scriptclasses.FilesMetadataReader;
-  %jar /buckets/bfsdefault/<BUCKET>/exasol-cloud-storage-extension-2.9.3.jar;
+  %jar /buckets/bfsdefault/<BUCKET>/exasol-cloud-storage-extension-2.9.4.jar;
 /
 
 CREATE OR REPLACE JAVA SET SCRIPT IMPORT_FILES(...) EMITS (...) AS
   %scriptclass com.exasol.cloudetl.scriptclasses.FilesDataImporter;
-  %jar /buckets/bfsdefault/<BUCKET>/exasol-cloud-storage-extension-2.9.3.jar;
+  %jar /buckets/bfsdefault/<BUCKET>/exasol-cloud-storage-extension-2.9.4.jar;
 /
 ```
 
@@ -271,12 +271,12 @@ OPEN SCHEMA CLOUD_STORAGE_EXTENSION;
 
 CREATE OR REPLACE JAVA SET SCRIPT EXPORT_PATH(...) EMITS (...) AS
   %scriptclass com.exasol.cloudetl.scriptclasses.TableExportQueryGenerator;
-  %jar /buckets/bfsdefault/<BUCKET>/exasol-cloud-storage-extension-2.9.3.jar;
+  %jar /buckets/bfsdefault/<BUCKET>/exasol-cloud-storage-extension-2.9.4.jar;
 /
 
 CREATE OR REPLACE JAVA SET SCRIPT EXPORT_TABLE(...) EMITS (ROWS_AFFECTED INT) AS
   %scriptclass com.exasol.cloudetl.scriptclasses.TableDataExporter;
-  %jar /buckets/bfsdefault/<BUCKET>/exasol-cloud-storage-extension-2.9.3.jar;
+  %jar /buckets/bfsdefault/<BUCKET>/exasol-cloud-storage-extension-2.9.4.jar;
 /
 ```
 
@@ -410,13 +410,13 @@ CREATE OR REPLACE JAVA SCALAR SCRIPT IMPORT_METADATA(...) EMITS (
 ) AS
   %jvmoption -DHTTPS_PROXY=http://username:password@10.10.1.10:1180
   %scriptclass com.exasol.cloudetl.scriptclasses.FilesMetadataReader;
-  %jar /buckets/bfsdefault/<BUCKET>/exasol-cloud-storage-extension-2.9.3.jar;
+  %jar /buckets/bfsdefault/<BUCKET>/exasol-cloud-storage-extension-2.9.4.jar;
 /
 
 CREATE OR REPLACE JAVA SET SCRIPT IMPORT_FILES(...) EMITS (...) AS
   %jvmoption -DHTTPS_PROXY=http://username:password@10.10.1.10:1180
   %scriptclass com.exasol.cloudetl.scriptclasses.FilesDataImporter;
-  %jar /buckets/bfsdefault/<BUCKET>/exasol-cloud-storage-extension-2.9.3.jar;
+  %jar /buckets/bfsdefault/<BUCKET>/exasol-cloud-storage-extension-2.9.4.jar;
 /
 ```
 
@@ -1200,7 +1200,7 @@ In this case, full script will look like this:
 CREATE OR REPLACE JAVA SET SCRIPT IMPORT_PATH(...) EMITS (...) AS
 %jvmoption --add-exports=java.base/sun.nio.ch=ALL-UNNAMED;
 %scriptclass com.exasol.cloudetl.scriptclasses.FilesImportQueryGenerator;
-%jar /buckets/bfsdefault/default/exasol-cloud-storage-extension-2.9.3.jar;
+%jar /buckets/bfsdefault/default/exasol-cloud-storage-extension-2.9.4.jar;
 /
 ```
 

doc/changes/changes_2.9.4.md

@@ -3,14 +3,14 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.exasol</groupId>
     <artifactId>cloud-storage-extension</artifactId>
-    <version>2.9.3</version>
+    <version>2.9.4</version>
     <name>Cloud Storage Extension</name>
     <description>Exasol Cloud Storage Import And Export Extension</description>
     <url>https://github.com/exasol/cloud-storage-extension/</url>
     <parent>
         <artifactId>cloud-storage-extension-generated-parent</artifactId>
         <groupId>com.exasol</groupId>
-        <version>2.9.3</version>
+        <version>2.9.4</version>
         <relativePath>pk_generated_parent.pom</relativePath>
     </parent>
     <properties>
@@ -39,7 +39,7 @@
             <dependency>
                 <groupId>io.netty</groupId>
                 <artifactId>netty-bom</artifactId>
-                <version>4.2.9.Final</version>
+                <version>4.2.12.Final</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
@@ -260,7 +260,7 @@
             <!-- override version 3.6.3 to fix vulnerability CVE-2023-42503, CVE-2024-23944 & CVE-2024-51504 -->
             <groupId>org.apache.zookeeper</groupId>
             <artifactId>zookeeper</artifactId>
-            <version>3.9.4</version>
+            <version>3.9.5</version>
         </dependency>
         <dependency>
             <!-- Upgrade transitive dependency of org.apache.zookeeper:zookeeper to fix CVE-2023-6378 -->
@@ -482,7 +482,7 @@
         <dependency>
             <groupId>org.apache.orc</groupId>
             <artifactId>orc-core</artifactId>
-            <version>1.9.7</version>
+            <version>1.9.8</version>
             <exclusions>
                 <!-- exluded because of duplicate-finder-maven-plugin -->
                 <exclusion>
@@ -500,7 +500,7 @@
             <!-- Update transitive dependency of org.apache.spark:spark-core to fix CVE-2024-47561 -->
             <groupId>org.apache.avro</groupId>
             <artifactId>avro</artifactId>
-            <version>1.12.0</version>
+            <version>1.12.1</version>
             <exclusions>
                 <!-- excluded because of duplicate-finder-maven-plugin -->
                 <exclusion>
@@ -960,7 +960,7 @@
             <plugin>
                 <groupId>com.exasol</groupId>
                 <artifactId>project-keeper-maven-plugin</artifactId>
-                <version>5.4.5</version>
+                <version>5.4.6</version>
                 <executions>
                     <execution>
                         <goals>

doc/user_guide/user_guide.md

@@ -241,7 +241,7 @@ class AvroDataImporterIT extends BaseDataImporter {
       .withInputValues(List(java.util.List.of(1.01, 3.14, 2.71)))
       .assertResultSet(
         table()
-          .row("[1.0099999904632568,3.140000104904175,2.7100000381469727]")
+          .row("[1.01,3.14,2.71]")
           .matches()
       )
   }