Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
273 changes: 273 additions & 0 deletions aws-core/2.30.22.wso2v3/pom.xml
Original file line number Diff line number Diff line change
@@ -0,0 +1,273 @@
<?xml version="1.0" encoding="utf-8"?>
<!--
~ Copyright (c) 2025, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
~
~ WSO2 LLC. licenses this file to you under the Apache License,
~ Version 2.0 (the "License"); you may not use this file except
~ in compliance with the License.
~ You may obtain a copy of the License at
~
~ http://www.apache.org/licenses/LICENSE-2.0
~
~ Unless required by applicable law or agreed to in writing,
~ software distributed under the License is distributed on an
~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
~ KIND, either express or implied. See the License for the
~ specific language governing permissions and limitations
~ under the License.
-->

<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

<modelVersion>4.0.0</modelVersion>
<groupId>org.wso2.orbit.software.amazon.awssdk</groupId>
<artifactId>aws-core</artifactId>
<packaging>bundle</packaging>
<name>AWS-Core</name>
<version>${awscore.orbit.version}</version>
<description>A custom bundle that wraps aws-java-sdk-core/lambda/apigateway and other related dependencies</description>
<url>http://www.wso2.com</url>

<dependencies>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>aws-core</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>lambda</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>sts</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>apigateway</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>auth</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>apache-client</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>aws-sdk-java</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>apigatewayv2</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>aws-json-protocol</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>regions</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>http-client-spi</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>utils</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>identity-spi</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>retries-spi</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>retries</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>profiles</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>endpoints-spi</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>http-auth-spi</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>http-auth-aws</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>metrics-spi</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>protocol-core</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>third-party-jackson-core</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>checksums</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>checksums-spi</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>http-auth</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>sdk-core</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>json-utils</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk.crt</groupId>
<artifactId>aws-crt</artifactId>
<version>${software.amazon.awssdk.crt.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.eventstream</groupId>
<artifactId>eventstream</artifactId>
<version>${software.amazon.eventstream.version}</version>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>aws-query-protocol</artifactId>
<version>${software.amazon.awssdk.version}</version>
</dependency>
</dependencies>
Comment on lines +33 to +184
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

file="aws-core/2.30.22.wso2v3/pom.xml"

echo "=== Check whether netty-codec-http2 is currently pinned in this POM ==="
rg -n '<groupId>io\.netty</groupId>|<artifactId>netty-codec-http2</artifactId>|<netty\.codec\.http2\.version>' "$file" || echo "No direct netty-codec-http2 pins found"

echo ""
echo "=== Check if file exists and show first 50 lines ==="
if [ -f "$file" ]; then
    head -50 "$file"
else
    echo "File not found: $file"
fi

echo ""
echo "=== Fetch advisory metadata from OSV ==="
python3 <<'PY'
import json
import urllib.request
import urllib.error

try:
    url = "https://api.osv.dev/v1/vulns/GHSA-prj3-ccx8-p6x4"
    req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
    with urllib.request.urlopen(req, timeout=10) as response:
        data = json.loads(response.read().decode('utf-8'))
    
    print("Advisory ID:", data.get("id"))
    print("Summary:", data.get("summary", "N/A")[:200])
    print("\nAffected packages:")
    for affected in data.get("affected", []):
        pkg = affected.get("package", {})
        ecosystem = pkg.get("ecosystem", "")
        name = pkg.get("name", "")
        if ecosystem == "Maven":
            print(f"  Package: {name} (Ecosystem: {ecosystem})")
            for range_item in affected.get("ranges", []):
                if range_item.get("type") == "ECOSYSTEM":
                    print(f"  Range type: ECOSYSTEM")
                    print(f"  Events: {range_item.get('events', [])}")
except Exception as e:
    print(f"Error fetching OSV data: {e}")
PY

Repository: wso2/orbit

Length of output: 2489


🏁 Script executed:

#!/bin/bash
set -euo pipefail

file="aws-core/2.30.22.wso2v3/pom.xml"

echo "=== Search for properties/version definitions ==="
rg -A 5 '<properties>' "$file" | head -50

echo ""
echo "=== Search for software.amazon.awssdk.version ==="
rg '<software\.amazon\.awssdk\.version>' "$file"

echo ""
echo "=== Full file line count and structure ==="
wc -l "$file"

echo ""
echo "=== Check for any netty-related content in entire file ==="
rg -i 'netty' "$file" || echo "No netty mentions found"

Repository: wso2/orbit

Length of output: 763


🌐 Web query:

GHSA-prj3-ccx8-p6x4 netty-codec-http2 vulnerability

💡 Result:

GHSA-prj3-ccx8-p6x4 is a DDoS / resource-exhaustion vulnerability in Netty’s HTTP/2 codec (io.netty:netty-codec-http2), assigned CVE-2025-55163. An attacker can send malformed HTTP/2 control frames that cause the server to emit RST_STREAM and incorrectly “free” the stream from the max-concurrent-streams counter, allowing unbounded concurrent backend work and resulting in CPU/memory exhaustion (DoS/DDoS). [1]

  • Affected (upstream Netty): netty-codec-http2 <= 4.1.123.Final and <= 4.2.3.Final (i.e., the 4.2 line before 4.2.4). [1]
  • Fixed in: 4.1.124.Final and 4.2.4.Final. [1][2]
  • Mitigations (if you can’t upgrade immediately): rate/limit server-sent RST_STREAM and/or rate/limit client control frames (e.g., WINDOW_UPDATE, PRIORITY), and treat certain flow/protocol errors as connection errors. [1][3]

Note: Some downstream artifacts (e.g., grpc-netty-shaded) may also be impacted depending on the bundled Netty version. [4]

Sources: [1] GitHub Netty advisory, [2] Snyk entry (CVE-2025-55163), [3] CERT/CC MadeYouReset note, [4] Resolved Security catalog entry.


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Check entire POM for dependencyManagement or parent references ==="
cat aws-core/2.30.22.wso2v3/pom.xml | head -100

echo ""
echo "=== Look for parent POM definition ==="
rg -A 5 '<parent>' aws-core/2.30.22.wso2v3/pom.xml || echo "No parent POM"

echo ""
echo "=== Check Maven Central for AWS SDK 2.30.22 dependencies ==="
python3 <<'PYTHON'
import json
import urllib.request
import urllib.error

try:
    # Check Maven Central for aws-core 2.30.22 POM
    url = "https://repo1.maven.org/maven2/software/amazon/awssdk/aws-core/2.30.22/aws-core-2.30.22.pom"
    req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
    with urllib.request.urlopen(req, timeout=10) as response:
        pom_content = response.read().decode('utf-8')
        # Look for netty dependencies
        if 'netty' in pom_content.lower():
            lines = pom_content.split('\n')
            for i, line in enumerate(lines):
                if 'netty' in line.lower():
                    print(f"Line {i}: {line.strip()}")
                    # Print context
                    for j in range(max(0, i-2), min(len(lines), i+3)):
                        if j != i:
                            print(f"  {lines[j].strip()}")
        else:
            print("No netty references found in aws-core 2.30.22 POM")
except Exception as e:
    print(f"Error fetching POM: {e}")
PYTHON

Repository: wso2/orbit

Length of output: 4571


🌐 Web query:

AWS SDK for Java 2.30.22 netty-codec-http2 version dependencies

💡 Result:

For AWS SDK for Java v2.30.22 (artifact software.amazon.awssdk:netty-nio-client:2.30.22), the Netty HTTP/2 codec dependency resolves to:

  • io.netty:netty-codec-http2:4.1.118.Final [1]

(Other Netty modules pulled by the same artifact—e.g., netty-codec-http, netty-handler, etc.—are also 4.1.118.Final.) [1]

Sources:
[1] https://mvnrepository.com/artifact/software.amazon.awssdk/netty-nio-client/2.30.22/dependencies


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Search for AWS SDK release notes or version info ==="
# Try to find any local reference to SDK dependencies or changelog
find . -name "*2.30.22*" -o -name "*CHANGELOG*" -o -name "*RELEASES*" 2>/dev/null | head -20

echo ""
echo "=== Check if there's any dependency documentation ==="
find . -name "*.md" -o -name "*.txt" 2>/dev/null | xargs grep -l "2.30.22" 2>/dev/null | head -10

echo ""
echo "=== List all files in aws-core directory ==="
ls -la aws-core/2.30.22.wso2v3/ | head -30

Repository: wso2/orbit

Length of output: 245


Add explicit netty-codec-http2 version override to address GHSA-prj3-ccx8-p6x4 (CVE-2025-55163).

AWS SDK 2.30.22 transitively brings in io.netty:netty-codec-http2:4.1.118.Final, which is vulnerable to a DDoS attack exploiting malformed HTTP/2 control frames that cause unbounded concurrent stream handling and resource exhaustion. Add a dependencyManagement override to pin netty-codec-http2 to 4.1.124.Final or later.

🛡️ Suggested mitigation pattern
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>io.netty</groupId>
+                <artifactId>netty-codec-http2</artifactId>
+                <version>4.1.124.Final</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
...
     <properties>
         <software.amazon.awssdk.version>2.30.22</software.amazon.awssdk.version>
+        <netty.codec.http2.version>4.1.124.Final</netty.codec.http2.version>
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@aws-core/2.30.22.wso2v3/pom.xml` around lines 33 - 184, Add a
dependencyManagement override pinning io.netty:netty-codec-http2 to
4.1.124.Final (or later) in the POM: create or update the
<dependencyManagement><dependencies> section and add a <dependency> with
<groupId>io.netty</groupId>, <artifactId>netty-codec-http2</artifactId> and
<version>4.1.124.Final</version> so that the transitive netty-codec-http2 pulled
in by AWS SDK (from dependencies like aws-core / aws-sdk-java) is replaced;
ensure the new dependency is added at the same POM level as the existing
<dependencies> block so Maven attribute resolution applies project-wide.


<distributionManagement>
<repository>
<id>wso2.releases</id>
<name>WSO2 internal Repository</name>
<url>https://maven.wso2.org/nexus/content/repositories/releases/</url>
</repository>
<snapshotRepository>
<id>wso2.snapshots</id>
<name>Apache Snapshot Repository</name>
<url>https://maven.wso2.org/nexus/content/repositories/snapshots/</url>
</snapshotRepository>
</distributionManagement>

<build>
<plugins>
<plugin>
<groupId>org.apache.felix</groupId>
<artifactId>maven-bundle-plugin</artifactId>
<version>3.5.0</version>
<extensions>true</extensions>
<configuration>
<instructions>
<Bundle-SymbolicName>${project.artifactId}</Bundle-SymbolicName>
<Bundle-Name>${project.artifactId}</Bundle-Name>
<Export-Package>
software.amazon.awssdk.services.apigateway.*; version="${awscore.orbit.version}",
software.amazon.awssdk.services.apigatewayv2.*; version="${awscore.orbit.version}",
software.amazon.awssdk.core.*; version="${awscore.orbit.version}",
software.amazon.awssdk.auth.*; version="${awscore.orbit.version}",
software.amazon.awssdk.awscore.*; version="${awscore.orbit.version}",
software.amazon.awssdk.auth.credentials.*; version="${awscore.orbit.version}",
software.amazon.awssdk.http.*; version="${awscore.orbit.version}",
software.amazon.awssdk.regions.*; version="${awscore.orbit.version}",
software.amazon.awssdk.services.lambda.*; version="${awscore.orbit.version}",
software.amazon.awssdk.services.sts.*; version="${awscore.orbit.version}",
software.amazon.awssdk.crt.*; version="${software.amazon.awssdk.crt.version}",
software.amazon.eventstream.*; version="${software.amazon.eventstream.version}"
</Export-Package>
<Embed-Dependency>
aws-core;utils,scope=compile|runtime;inline=false,
regions;scope=compile|runtime;inline=false,
Comment on lines +224 to +226
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Malformed Embed-Dependency clause leaves utils un-embedded.

Line 225 reads aws-core;utils,scope=compile|runtime;inline=false. In the maven-bundle-plugin DSL, each entry in Embed-Dependency is a comma-delimited clause of the form MATCH;attribute=value. The semicolon after aws-core begins the attribute list, so utils is parsed as a bare (valueless) attribute name on the aws-core clause, not as a second artifact to embed. The comma then starts a new clause whose MATCH text would be scope=compile|runtime (no real artifact ID), and inline=false becomes its only attribute. The software.amazon.awssdk:utils jar is therefore never embedded.

🐛 Proposed fix — split into two explicit entries
-                            aws-core;utils,scope=compile|runtime;inline=false,
+                            aws-core;scope=compile|runtime;inline=false,
+                            utils;scope=compile|runtime;inline=false,
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@aws-core/2.30.22.wso2v3/pom.xml` around lines 224 - 226, The Embed-Dependency
line is malformed and causes software.amazon.awssdk:utils to be treated as an
attribute rather than a separate clause; update the Embed-Dependency entries so
each artifact is its own comma-separated clause with its attributes, e.g. split
the current single clause that reads like "aws-core;utils,scope=..." into two
explicit clauses such as "aws-core;scope=compile|runtime;inline=false" and
"software.amazon.awssdk:utils;scope=compile|runtime;inline=false" so that the
utils artifact is correctly matched and embedded by the maven-bundle-plugin.

apache-client;scope=compile|runtime;inline=false,
apigateway;scope=compile|runtime;inline=false,
apigatewayv2;scope=compile|runtime;inline=false,
identity-spi;scope=compile|runtime;inline=false,
retries-spi;scope=compile|runtime;inline=false,
profiles;scope=compile|runtime;inline=false,
endpoints-spi;scope=compile|runtime;inline=false,
http-auth-spi;scope=compile|runtime;inline=false,
auth;scope=compile|runtime;inline=false,
http-auth-aws;scope=compile|runtime;inline=false,
aws-json-protocol;scope=compile|runtime;inline=false,
metrics-spi;scope=compile|runtime;inline=false,
protocol-core;scope=compile|runtime;inline=false,
json-utils;scope=compile|runtime;inline=false,
third-party-jackson-core;scope=compile|runtime;inline=false,
checksums;scope=compile|runtime;inline=false,
checksums-spi;scope=compile|runtime;inline=false,
http-auth;scope=compile|runtime;inline=false,
lambda;scope=compile|runtime;inline=false,
http-client-spi;scope=compile|runtime;inline=false,
metrics-spi;scope=compile|runtime;inline=false,
retries;scope=compile|runtime;inline=false,
Comment on lines +238 to +248
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

metrics-spi is listed twice in Embed-Dependency (lines 238 and 247).

The duplicate is a no-op at runtime but will trigger a BND warning during the build and makes the manifest harder to audit.

🐛 Proposed fix
                             metrics-spi;scope=compile|runtime;inline=false,
                             protocol-core;scope=compile|runtime;inline=false,
                             json-utils;scope=compile|runtime;inline=false,
                             third-party-jackson-core;scope=compile|runtime;inline=false,
                             checksums;scope=compile|runtime;inline=false,
                             checksums-spi;scope=compile|runtime;inline=false,
                             http-auth;scope=compile|runtime;inline=false,
                             lambda;scope=compile|runtime;inline=false,
                             http-client-spi;scope=compile|runtime;inline=false,
-                            metrics-spi;scope=compile|runtime;inline=false,
                             retries;scope=compile|runtime;inline=false,
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
metrics-spi;scope=compile|runtime;inline=false,
protocol-core;scope=compile|runtime;inline=false,
json-utils;scope=compile|runtime;inline=false,
third-party-jackson-core;scope=compile|runtime;inline=false,
checksums;scope=compile|runtime;inline=false,
checksums-spi;scope=compile|runtime;inline=false,
http-auth;scope=compile|runtime;inline=false,
lambda;scope=compile|runtime;inline=false,
http-client-spi;scope=compile|runtime;inline=false,
metrics-spi;scope=compile|runtime;inline=false,
retries;scope=compile|runtime;inline=false,
metrics-spi;scope=compile|runtime;inline=false,
protocol-core;scope=compile|runtime;inline=false,
json-utils;scope=compile|runtime;inline=false,
third-party-jackson-core;scope=compile|runtime;inline=false,
checksums;scope=compile|runtime;inline=false,
checksums-spi;scope=compile|runtime;inline=false,
http-auth;scope=compile|runtime;inline=false,
lambda;scope=compile|runtime;inline=false,
http-client-spi;scope=compile|runtime;inline=false,
retries;scope=compile|runtime;inline=false,
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@aws-core/2.30.22.wso2v3/pom.xml` around lines 238 - 248, The Embed-Dependency
list in the POM contains a duplicated entry "metrics-spi" which triggers BND
warnings; open the Embed-Dependency block and remove the redundant
"metrics-spi;scope=compile|runtime;inline=false" entry so it only appears once
(leave the other dependency lines unchanged), ensuring the manifest no longer
contains duplicate metrics-spi entries.

sdk-core;scope=compile|runtime;inline=false,
sts;scope=compile|runtime;inline=false,
aws-crt;scope=compile|runtime;inline=false,
eventstream;scope=compile|runtime;inline=false
</Embed-Dependency>
<Import-Package>
*;resolution:=optional
</Import-Package>
<Private-Package>
</Private-Package>
<DynamicImport-Package>*</DynamicImport-Package>
</instructions>
</configuration>
</plugin>
</plugins>
</build>

<properties>
<software.amazon.awssdk.version>2.30.22</software.amazon.awssdk.version>
<software.amazon.awssdk.crt.version>0.29.22</software.amazon.awssdk.crt.version>
<software.amazon.eventstream.version>1.0.1</software.amazon.eventstream.version>
<awscore.orbit.version>2.30.22.wso2v3</awscore.orbit.version>
</properties>

</project>