Security Vulnerability fix for helix-core [CVE-2023-38647]

[mehradpk]

Description

Fixes the helix-core security vulnerability CVE-2023-38647 by removing helix-core package from presto-pinot.

Motivation and Context

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run in Helix REST start and Workflow creation. Affect all the versions lower and include 1.2.0. Affected products: helix-core, helix-rest Mitigation: Short term, stop using any YAML based configuration and workflow creation.

Impact

NA

Test Plan

Contributor checklist

• Please make sure your submission complies with our development, formatting, commit message, and attribution guidelines.
• PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
• Documented new properties (with its default value), SQL syntax, functions, or other functionality.
• If release notes are required, they follow the release notes guidelines.
• Adequate tests were added if applicable.
• CI passed.

Release Notes

== RELEASE NOTES ==

Security Changes
* Remove helix-core from presto-pinot to address `CVE-2023-38647 <https://nvd.nist.gov/vuln/detail/CVE-2023-38647>` :pr:`#23820`

[linux-foundation-easycla]

• ✅login: mehradpk / (2b06855)
• ✅login: mehradpk / (2b06855, 5b0318c)

The committers listed above are authorized under a signed CLA.

[steveburnett]

Please revise the release note entry to include the PR number, and also to follow the Order of changes in the Release Notes Guidelines.

Maybe something like:

== RELEASE NOTES ==

Security Changes
* Remove helix-core from presto-pinot to address `CVE-2023-38647 <https://nvd.nist.gov/vuln/detail/CVE-2023-38647>`_ :pr:`23820`

[mehradpk]

Please revise the release note entry to include the PR number, and also to follow the Order of changes in the Release Notes Guidelines.

Maybe something like:

== RELEASE NOTES ==

Security Changes
* Remove helix-core from presto-pinot to address `CVE-2023-38647 <https://nvd.nist.gov/vuln/detail/CVE-2023-38647>`_ :pr:`23820`

Thanks for pointing out. Updated the release note.

[agrawalreetika]

Please squash your commits into a single commit may be something like -
Fix CVE-2023-38647 helix-core in presto-pinot connector

Also rebase your PR on lastest master as well.

[imjalpreet]

Are we confident this dependency is not required? Can we not upgrade the dependency to a newer version without the CVE?

[imjalpreet]

I see that the most recent versions of helix-core don't have any CVE - https://mvnrepository.com/artifact/org.apache.helix/helix-core

I also see that newer versions of Pinot are already on one of these versions, we can also explore upgrading Pinot if it's relatively less complex.