Merge pull request #521 from boozallen/518-cve-remediation

#518 Resolve CVEs within hive metastore docker image
boozallen · Jan 3, 2025 · 4a95e9b · 4a95e9b
2 parents 1cd838a + 0bfb94c
commit 4a95e9b
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/extensions/extensions-docker/aissemble-hive-service/pom.xml b/extensions/extensions-docker/aissemble-hive-service/pom.xml
@@ -57,6 +57,7 @@
                     <outputDirectory>${dockerbuild.jars.directory}</outputDirectory>
                     <includeTypes>jar</includeTypes>
                     <excludeTransitive>true</excludeTransitive>
+                    <includeArtifactIds>delta-hive_2.12,mysql-connector-java</includeArtifactIds>
                 </configuration>
                 <executions>
                     <execution>

diff --git a/extensions/extensions-docker/aissemble-hive-service/src/main/resources/docker/Dockerfile b/extensions/extensions-docker/aissemble-hive-service/src/main/resources/docker/Dockerfile
@@ -22,6 +22,11 @@ RUN groupadd -rf hive --gid=1000 && \
 
 ADD ${JARS_DIR}/* $HIVE_HOME/lib/
 
+# Remove jars with open vulnerabilities. These jars are included in the apache hive image but not necessary
+# when running the hive metastore only
+RUN rm ${HIVE_HOME}/lib/avatica-1.12.0.jar ${HIVE_HOME}/lib/htrace-core-3.1.0-incubating.jar \
+    ${HADOOP_HOME}/share/hadoop/yarn/timelineservice/lib/htrace-core-3.1.0-incubating.jar  
+
 USER hive
 
 ENTRYPOINT ["/opt/hive/bin/hive", "--skiphadoopversion", "--skiphbasecp", "--verbose", "--service", "metastore"]