From d99bccd6493ceb7aed4e05b05f81913ea876d855 Mon Sep 17 00:00:00 2001
From: Brandon Williams <brandonwilliams@apache.org>
Date: Thu, 22 Jun 2023 11:55:09 -0500
Subject: [PATCH 1/2] Suppress CVE-2023-34455, CVE-2023-34454, CVE-2023-34453

Patch by brandonwilliams; reviewed by bereng for CASSANDRA-18608
---
 .build/dependency-check-suppressions.xml | 7 +++++++
 CHANGES.txt                              | 1 +
 2 files changed, 8 insertions(+)

diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
index 02dbb8dd92..08bf3f7236 100644
--- a/.build/dependency-check-suppressions.xml
+++ b/.build/dependency-check-suppressions.xml
@@ -20,6 +20,13 @@
   https://jeremylong.github.io/DependencyCheck/general/suppression.html
 -->
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+    <suppress>
+        <!--  https://issues.apache.org/jira/browse/CASSANDRA-18608 -->
+        <packageUrl regex="true">^pkg:maven/org\.xerial\.snappy/snappy\-java@.*$</packageUrl>
+        <cve>CVE-2023-34453</cve>
+        <cve>CVE-2023-34454</cve>
+        <cve>CVE-2023-34455</cve>
+    </suppress>
     <suppress>
         <!--  https://issues.apache.org/jira/browse/CASSANDRA-16150 -->
         <packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
diff --git a/CHANGES.txt b/CHANGES.txt
index 6e0853c3a4..43b4cc40fb 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,4 +1,5 @@
 3.0.30
+ * Suppress CVE-2023-34455, CVE-2023-34454, CVE-2023-34453 (CASSANDRA-18608)
  * Backport CASSANDRA-10508: Remove hard-coded SSL cipher suites (CASSANDRA-18575)
  * Suppress CVE-2023-2976 (CASSANDRA-18562)
  * Remove dh_python use in Debian packaging (CASSANDRA-18558)

From 776b33753b4779efc33a80acf3feb7da767c1bbf Mon Sep 17 00:00:00 2001
From: Brandon Williams <brandonwilliams@apache.org>
Date: Fri, 23 Jun 2023 09:43:09 -0500
Subject: [PATCH 2/2] Upgrade snappy to 1.1.10.1

Patch by brandonwilliams; reviewed by bereng for CASSANDRA-18608
---
 CHANGES.txt | 1 +
 build.xml   | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 1d76328e15..43a33eb9e7 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,4 +1,5 @@
 4.0.11
+ * Upgrade snappy to 1.1.10.1 (CASSANDRA-18608)
  * Fix assertion error when describing mv as table (CASSANDRA-18596)
  * Track the amount of read data per row (CASSANDRA-18513)
  * Fix Down nodes counter in nodetool describecluster (CASSANDRA-18512)
diff --git a/build.xml b/build.xml
index f50cb9bf4d..e6f0a4ce5e 100644
--- a/build.xml
+++ b/build.xml
@@ -511,7 +511,7 @@
         <license name="The Apache Software License, Version 2.0" url="https://www.apache.org/licenses/LICENSE-2.0.txt"/>
         <scm connection="${scm.connection}" developerConnection="${scm.developerConnection}" url="${scm.url}"/>
         <dependencyManagement>
-          <dependency groupId="org.xerial.snappy" artifactId="snappy-java" version="1.1.2.6"/>
+          <dependency groupId="org.xerial.snappy" artifactId="snappy-java" version="1.1.10.1"/>
           <dependency groupId="org.lz4" artifactId="lz4-java" version="1.8.0"/>
           <dependency groupId="com.ning" artifactId="compress-lzf" version="0.8.4" scope="provided"/>
           <dependency groupId="com.github.luben" artifactId="zstd-jni" version="1.5.5-1"/>