From 6e6b8f502a2ee296fdbd8ff6125adc3f5ee548bf Mon Sep 17 00:00:00 2001
From: Milton Ortegon <v-miltortegon@expediagroup.com>
Date: Mon, 16 Mar 2026 11:04:27 -0500
Subject: [PATCH 1/2] Fix critical vulnerabilities

---
 drone-fly-app/pom.xml                         | 71 +++++++++++++++++++
 drone-fly-core/pom.xml                        | 18 +++--
 .../dronefly/core/DroneFlyCoreTest.java       |  2 +-
 .../core/integration/DummyListener.java       |  2 +-
 pom.xml                                       | 24 +++++++
 5 files changed, 109 insertions(+), 8 deletions(-)

diff --git a/drone-fly-app/pom.xml b/drone-fly-app/pom.xml
index a91311b..982f276 100644
--- a/drone-fly-app/pom.xml
+++ b/drone-fly-app/pom.xml
@@ -15,10 +15,16 @@
     <aws.version>1.11.532</aws.version>
     <s3mock.version>0.2.5</s3mock.version>
     <hive.version>4.0.1</hive.version>
+    <avro.version>1.11.4</avro.version>
+    <kerb.version>2.0.1</kerb.version>
     <docker.container.port>8008</docker.container.port>
   </properties>
 
   <dependencies>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-web</artifactId>
+    </dependency>
     <dependency>
       <groupId>com.expediagroup</groupId>
       <artifactId>drone-fly-core</artifactId>
@@ -88,8 +94,30 @@
           <artifactId>jdk.tools</artifactId>
           <groupId>jdk.tools</groupId>
         </exclusion>
+        <exclusion>
+          <groupId>org.apache.logging.log4j</groupId>
+          <artifactId>log4j-1.2-api</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.avro</groupId>
+          <artifactId>avro</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.kerby</groupId>
+          <artifactId>kerb-admin</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>
+    <dependency>
+      <groupId>org.apache.avro</groupId>
+      <artifactId>avro</artifactId>
+      <version>${avro.version}</version>
+    </dependency>
+    <!--dependency>
+      <groupId>org.apache.kerby</groupId>
+      <artifactId>kerb-admin</artifactId>
+      <version>${kerb.version}</version>
+    </dependency-->
     <dependency>
       <groupId>org.apache.hive</groupId>
       <artifactId>hive-standalone-metastore-server</artifactId>
@@ -131,6 +159,14 @@
           <groupId>tomcat</groupId>
           <artifactId>jasper-runtime</artifactId>
         </exclusion>
+        <exclusion>
+          <groupId>org.apache.hadoop</groupId>
+          <artifactId>hadoop-common</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.logging.log4j</groupId>
+          <artifactId>log4j-1.2-api</artifactId>
+        </exclusion>
       </exclusions>
     </dependency>
     <dependency>
@@ -155,12 +191,32 @@
       <groupId>org.apache.hadoop</groupId>
       <artifactId>hadoop-client-runtime</artifactId>
       <version>3.3.6</version>
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.avro</groupId>
+          <artifactId>avro</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.kerby</groupId>
+          <artifactId>kerb-admin</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.apache.hadoop</groupId>
       <artifactId>hadoop-mapreduce-client-core</artifactId>
       <version>3.3.6</version>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>org.apache.avro</groupId>
+          <artifactId>avro</artifactId>
+        </exclusion>
+        <exclusion>
+          <groupId>org.apache.kerby</groupId>
+          <artifactId>kerb-admin</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
@@ -177,6 +233,21 @@
       <artifactId>awaitility</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.apache.tomcat.embed</groupId>
+      <artifactId>tomcat-embed-core</artifactId>
+      <version>${tomcat.embeded.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.tomcat.embed</groupId>
+      <artifactId>tomcat-embed-el</artifactId>
+      <version>${tomcat.embeded.version}</version>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.tomcat.embed</groupId>
+      <artifactId>tomcat-embed-websocket</artifactId>
+      <version>${tomcat.embeded.version}</version>
+    </dependency>
   </dependencies>
 
   <build>
diff --git a/drone-fly-core/pom.xml b/drone-fly-core/pom.xml
index 50aefcc..d5e51d9 100644
--- a/drone-fly-core/pom.xml
+++ b/drone-fly-core/pom.xml
@@ -26,12 +26,18 @@
     <dependency>
       <groupId>org.springframework.boot</groupId>
       <artifactId>spring-boot-starter-web</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>org.springframework.boot</groupId>
-          <artifactId>spring-boot-starter-logging</artifactId>
-        </exclusion>
-      </exclusions>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.tomcat.embed</groupId>
+      <artifactId>tomcat-embed-core</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.tomcat.embed</groupId>
+      <artifactId>tomcat-embed-el</artifactId>
+    </dependency>
+    <dependency>
+      <groupId>org.apache.tomcat.embed</groupId>
+      <artifactId>tomcat-embed-websocket</artifactId>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
diff --git a/drone-fly-core/src/test/java/com/expediagroup/dataplatform/dronefly/core/DroneFlyCoreTest.java b/drone-fly-core/src/test/java/com/expediagroup/dataplatform/dronefly/core/DroneFlyCoreTest.java
index a0ce34e..7355572 100644
--- a/drone-fly-core/src/test/java/com/expediagroup/dataplatform/dronefly/core/DroneFlyCoreTest.java
+++ b/drone-fly-core/src/test/java/com/expediagroup/dataplatform/dronefly/core/DroneFlyCoreTest.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (C) 2020 Expedia, Inc.
+ * Copyright (C) 2020-2026 Expedia, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/drone-fly-integration-tests/src/test/java/com/expediagroup/dataplatform/dronefly/core/integration/DummyListener.java b/drone-fly-integration-tests/src/test/java/com/expediagroup/dataplatform/dronefly/core/integration/DummyListener.java
index 1ff92bd..9dfaa06 100644
--- a/drone-fly-integration-tests/src/test/java/com/expediagroup/dataplatform/dronefly/core/integration/DummyListener.java
+++ b/drone-fly-integration-tests/src/test/java/com/expediagroup/dataplatform/dronefly/core/integration/DummyListener.java
@@ -1,5 +1,5 @@
 /**
- * Copyright (C) 2020 Expedia, Inc.
+ * Copyright (C) 2020-2026 Expedia, Inc.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/pom.xml b/pom.xml
index 00accf7..d32770b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -39,6 +39,7 @@
     <springframework.boot.version>3.2.12</springframework.boot.version>
     <maven.shade.plugin.version>3.2.4</maven.shade.plugin.version>
     <jib.maven.plugin.version>3.4.3</jib.maven.plugin.version>
+    <tomcat.embeded.version>10.1.50</tomcat.embeded.version>
     <docker.from.image>amazoncorretto</docker.from.image>
     <docker.from.tag>21-al2023</docker.from.tag>
     <docker.from.reference>${docker.from.image}:${docker.from.tag}</docker.from.reference>
@@ -68,6 +69,29 @@
         <type>pom</type>
         <scope>import</scope>
       </dependency>
+      <dependency>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-web</artifactId>
+        <version>${springframework.boot.version}</version>
+        <exclusions>
+          <exclusion>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-logging</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>org.apache.tomcat.embed</groupId>
+            <artifactId>tomcat-embed-core</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>org.apache.tomcat.embed</groupId>
+            <artifactId>tomcat-embed-el</artifactId>
+          </exclusion>
+          <exclusion>
+            <groupId>org.apache.tomcat.embed</groupId>
+            <artifactId>tomcat-embed-websocket</artifactId>
+          </exclusion>
+        </exclusions>
+      </dependency>
     </dependencies>
   </dependencyManagement>
 

From efb9c263f8123efae4a4d0ef87750ed35470ac18 Mon Sep 17 00:00:00 2001
From: Milton Ortegon <v-miltortegon@expediagroup.com>
Date: Mon, 16 Mar 2026 11:52:51 -0500
Subject: [PATCH 2/2] Fix Avro/Kerby vulnerabilities by upgrading Hadoop to
 3.4.2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Upgrading hadoop-client-runtime from 3.3.6 to 3.4.2 resolves vulnerable
libraries bundled inside the shaded JAR that Maven exclusions cannot reach:
- Avro 1.7.7 → 1.11.3 (CVE-2023-39410, bundled via HADOOP-18880)
- Kerby 1.0.1 → 2.0.3 (CVE-2023-25613, bundled via HADOOP-18956)

Also removes the now-unnecessary explicit avro/kerb-admin dependency
declarations and exclusions that were working around the same issue.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 drone-fly-app/pom.xml | 45 +++----------------------------------------
 1 file changed, 3 insertions(+), 42 deletions(-)

diff --git a/drone-fly-app/pom.xml b/drone-fly-app/pom.xml
index 982f276..2acac08 100644
--- a/drone-fly-app/pom.xml
+++ b/drone-fly-app/pom.xml
@@ -15,8 +15,7 @@
     <aws.version>1.11.532</aws.version>
     <s3mock.version>0.2.5</s3mock.version>
     <hive.version>4.0.1</hive.version>
-    <avro.version>1.11.4</avro.version>
-    <kerb.version>2.0.1</kerb.version>
+    <hadoop.version>3.4.2</hadoop.version>
     <docker.container.port>8008</docker.container.port>
   </properties>
 
@@ -98,26 +97,8 @@
           <groupId>org.apache.logging.log4j</groupId>
           <artifactId>log4j-1.2-api</artifactId>
         </exclusion>
-        <exclusion>
-          <groupId>org.apache.avro</groupId>
-          <artifactId>avro</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.kerby</groupId>
-          <artifactId>kerb-admin</artifactId>
-        </exclusion>
       </exclusions>
     </dependency>
-    <dependency>
-      <groupId>org.apache.avro</groupId>
-      <artifactId>avro</artifactId>
-      <version>${avro.version}</version>
-    </dependency>
-    <!--dependency>
-      <groupId>org.apache.kerby</groupId>
-      <artifactId>kerb-admin</artifactId>
-      <version>${kerb.version}</version>
-    </dependency-->
     <dependency>
       <groupId>org.apache.hive</groupId>
       <artifactId>hive-standalone-metastore-server</artifactId>
@@ -190,33 +171,13 @@
     <dependency>
       <groupId>org.apache.hadoop</groupId>
       <artifactId>hadoop-client-runtime</artifactId>
-      <version>3.3.6</version>
-      <exclusions>
-        <exclusion>
-          <groupId>org.apache.avro</groupId>
-          <artifactId>avro</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.kerby</groupId>
-          <artifactId>kerb-admin</artifactId>
-        </exclusion>
-      </exclusions>
+      <version>${hadoop.version}</version>
     </dependency>
     <dependency>
       <groupId>org.apache.hadoop</groupId>
       <artifactId>hadoop-mapreduce-client-core</artifactId>
-      <version>3.3.6</version>
+      <version>${hadoop.version}</version>
       <scope>test</scope>
-      <exclusions>
-        <exclusion>
-          <groupId>org.apache.avro</groupId>
-          <artifactId>avro</artifactId>
-        </exclusion>
-        <exclusion>
-          <groupId>org.apache.kerby</groupId>
-          <artifactId>kerb-admin</artifactId>
-        </exclusion>
-      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>