Update to version v1.0.9

- Update java runtime libraries to address security vulnerabilities
aws-solutions · May 16, 2024 · 856ca66 · 856ca66
2 parents ba62545 + 3e2e6f2
commit 856ca66
Show file tree

Hide file tree

Showing 4 changed files with 32 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 =======
 
+## [1.0.9] - 2024-05-16
+
+### Update
+
+- Updated java runtime libraries to patch vulnerabilities
+
 ## [1.0.8] - 2024-05-14
 
 ### Fixed

diff --git a/source/infrastructure/test/mock-lambda-func/java-lambda/pom.xml b/source/infrastructure/test/mock-lambda-func/java-lambda/pom.xml
@@ -36,16 +36,28 @@
             <groupId>software.amazon.awssdk</groupId>
             <artifactId>dynamodb</artifactId>
         </dependency>
+        <dependency>
+            <groupId>com.amazonaws</groupId>
+            <artifactId>aws-java-sdk-xray</artifactId>
+            <version>1.12.722</version>
+        </dependency>
         <dependency>
             <groupId>software.amazon.lambda</groupId>
             <artifactId>powertools-tracing</artifactId>
             <version>1.18.0</version>
+            <exclusions>
+                <!--  upgrading to new version of x-ray sdk to address ion-java CVE -->
+                <exclusion>
+                    <groupId>com.amazonaws</groupId>
+                    <artifactId>aws-java-sdk-xray</artifactId>
+                </exclusion>
+            </exclusions>      
         </dependency>
         <dependency>
             <groupId>software.amazon.lambda</groupId>
             <artifactId>powertools-metrics</artifactId>
             <version>1.18.0</version>
-        </dependency>
+        </dependency>     
         <dependency>
             <groupId>com.amazonaws</groupId>
             <artifactId>aws-lambda-java-core</artifactId>

diff --git a/source/lambda/layers/custom-java-sdk-config/pom.xml b/source/lambda/layers/custom-java-sdk-config/pom.xml
@@ -38,10 +38,22 @@
         </dependencies>
     </dependencyManagement>
     <dependencies>
+        <dependency>
+            <groupId>com.amazonaws</groupId>
+            <artifactId>aws-java-sdk-xray</artifactId>
+            <version>1.12.722</version>
+        </dependency>
         <dependency>
             <groupId>software.amazon.lambda</groupId>
             <artifactId>powertools-tracing</artifactId>
             <version>1.18.0</version>
+            <exclusions>
+                <!--  upgrading to new version of x-ray sdk to address ion-java CVE -->
+                <exclusion>
+                    <groupId>com.amazonaws</groupId>
+                    <artifactId>aws-java-sdk-xray</artifactId>
+                </exclusion>
+            </exclusions>            
         </dependency>
         <dependency>
             <groupId>software.amazon.lambda</groupId>

diff --git a/source/ui/public/index.html b/source/ui/public/index.html
@@ -11,7 +11,7 @@
   <link rel="icon" href="%PUBLIC_URL%/favicon.png" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
   <meta name="theme-color" content="#000000" />
-  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; base-uri 'none'; upgrade-insecure-requests; img-src 'self' data: http://*.cloudfront.net https://*.amazonaws.com; script-src 'self' http://*.cloudfront.net https://*.amazonaws.com;
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; base-uri 'none'; upgrade-insecure-requests; img-src 'self' data: https://*.cloudfront.net https://*.amazonaws.com; script-src 'self' https://*.cloudfront.net https://*.amazonaws.com;
   style-src 'self' https://*.amazonaws.com; object-src 'none'; font-src 'self' https: data:;
   manifest-src 'self'; connect-src 'self' https://*.amazonaws.com" />
   <title>Enhanced Document Understanding on AWS</title>