secure version is utilized now

Author: joernNNN

apache/pinot/CVE-2024-56325/Dockerfile

@@ -13,18 +13,20 @@ RUN java -version
 
 FROM jdk21-base AS pinot
 
+ARG PINOT_VERSION=1.2.0
+
 RUN apt update && apt install wget -y
-RUN wget https://www.apache.org/dyn/closer.lua/pinot/apache-pinot-1.2.0/apache-pinot-1.2.0-bin.tar.gz?action=download -O apache-pinot-1.2.0-bin.tar.gz
-RUN tar -zxvf apache-pinot-1.2.0-bin.tar.gz
+RUN wget https://www.apache.org/dyn/closer.lua/pinot/apache-pinot-${PINOT_VERSION}/apache-pinot-${PINOT_VERSION}-bin.tar.gz?action=download -O apache-pinot-${PINOT_VERSION}-bin.tar.gz
+RUN tar -zxvf apache-pinot-${PINOT_VERSION}-bin.tar.gz
 
-WORKDIR /apache-pinot-1.2.0-bin
+WORKDIR /apache-pinot-${PINOT_VERSION}-bin
 
 
 COPY controller.conf controller.conf
 COPY broker.conf broker.conf
 COPY server.conf server.conf
 COPY minion.conf minion.conf
-COPY start-pinot.sh /apache-pinot-1.2.0-bin/start-pinot.sh
-RUN chmod +x /apache-pinot-1.2.0-bin/start-pinot.sh
+COPY start-pinot.sh /apache-pinot-${PINOT_VERSION}-bin/start-pinot.sh
+RUN chmod +x /apache-pinot-${PINOT_VERSION}-bin/start-pinot.sh
 
-CMD ["/apache-pinot-1.2.0-bin/start-pinot.sh"]
+CMD ["./start-pinot.sh"]

apache/pinot/CVE-2024-56325/README.md

@@ -1,14 +1,29 @@
 # setup vulnerable version
 ```bash
-docker build -t pinot-jdk21-debian:latest .
-docker run --rm -p 9000:9000 --name pinot-CVE-2024-56325 pinot-jdk21-debian:latest
+docker build --build-arg PINOT_VERSION=1.2.0 -t pinot-jdk21-debian:1.2.0 .
+docker run --rm -p 9000:9000 --name pinot-CVE-2024-56325 pinot-jdk21-debian:1.2.0
 ```
-# test vulnerable version
+## test vulnerable version
 ```bash
 curl -v http://localhost:9000/tables
 # 401 Unauthorized
 # {"code":401,"error":"HTTP 401 Unauthorized"}
 curl -v http://localhost:9000/tables\;.
 # 200 OK
 # {"tables":[]}
-```
+```
+
+# setup fixed version
+```bash
+docker build --build-arg PINOT_VERSION=1.3.0 -t pinot-jdk21-debian:1.3.0 .
+docker run --rm -p 9001:9000 --name pinot-CVE-2024-56325-patched pinot-jdk21-debian:1.3.0
+```
+## test secure version
+```bash
+curl -v http://localhost:9000/tables
+# 401 Unauthorized
+# {"code":401,"error":"HTTP 401 Unauthorized"}
+curl -v http://localhost:9000/tables\;.
+# 401 Unauthorized
+# {"code":401,"error":"HTTP 401 Unauthorized"}
+```