Databricks-jdbc and vulnerabilities CVE-2021-36090 CVE-2023-6378 CVE-2023-6481

[karthik-kobai]

The latest version of Databricks-jdbc available through Maven (2.6.36) now has these three vulnerabilities:

https://www.cve.org/CVERecord?id=CVE-2021-36090
https://www.cve.org/CVERecord?id=CVE-2023-6378
https://www.cve.org/CVERecord?id=CVE-2023-6481

All due to depending on and including in the jar the older versions of the below jar dependencies

org.apache.commons:commons-compress@1.20
ch.qos.logback:logback-classic@1.2.3
ch.qos.logback:logback-core@1.2.3

Is there a possibility to have a new updated version of Databricks-jdbc that uses the latest of these dependent jars?

org.apache.commons:commons-compress@1.25
ch.qos.logback:logback-classic@1.2.13 or @1.4.14
ch.qos.logback:logback-core@1.2.13 or @1.4.14

[Kaniz]

Hi @karthik-kobai, 

Thank you for bringing this to my attention! Let’s address the vulnerabilities in the Databricks JDBC driver.

The current version of the Databricks JDBC driver you mentioned is 2.6.36¹. It appears that this version has dependencies on older libraries, which have known vulnerabilities. Specifically:

1. org.apache.commons:commons-compress@1.20
2. ch.qos.logback:logback-classic@1.2.3
3. ch.qos.logback:logback-core@1.2.3

To mitigate these vulnerabilities, you can consider the following steps:

1. Check for Updates: First, verify if there is a newer version of the Databricks JDBC driver available. Databricks typically supports each driver version for at least 2 years¹. You can visit the Databricks JDBC Drivers Download page to find the latest version.

2. Replace Default Libraries: If a newer version is not available, you can manually replace the default libraries with updated versions. Databricks allows you to replace any of these libraries by using a cluster-scoped init script. Remove the default library jar and install the specific versions you require².

3. Specific Versions for Dependencies:

   • For org.apache.commons:commons-compress, consider using version 1.25.
   • For ch.qos.logback:logback-classic and ch.qos.logback:logback-core, you can choose either version 1....

Remember to thoroughly test the updated configuration to ensure compatibility with your use case. Stay vigilant about security and keep your dependencies up-to-date! 🛡️