Skip to content

HADOOP-18311. Upgrade dependencies to address several CVEs #4491

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
snmvaughan wants to merge 14 commits into from
Closed

HADOOP-18311. Upgrade dependencies to address several CVEs #4491

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
ab2b9ce
Replace htrace-core with hbase-noop-htrace for CVE-2018-7489
Jun 21, 2022
88da84a
Upgrade aws-java-sdk to address CVE-2018-7489
Jun 21, 2022
533b362
Upgrade to ZooKeeper 3.5.10 to address CVE-2020-10663
Jun 21, 2022
7100300
Upgrade Jetty to 9.4.46.* to address CVE PRISMA-2021-0182
Jun 21, 2022
3bcde00
Replace deprecated use of AllowSymLinkAliasChecker
Jun 23, 2022
5d327b8
HADOOP-18044. Hadoop - Upgrade to jQuery 3.6.0 (#3791)
steveloughran Jun 23, 2022
cf2675f
HADOOP-18068. upgrade AWS SDK to 1.12.132 (#3864)
steveloughran Jan 18, 2022
744f0bd
HADOOP-18085. S3 SDK Upgrade causes AccessPoint ARN endpoint mistrans…
bogthe Feb 4, 2022
9877efc
Replace htrace-core with hbase-noop-htrace for CVE-2018-7489
Jun 21, 2022
5496816
Upgrade aws-java-sdk to address CVE-2018-7489
Jun 21, 2022
2d8dc37
Upgrade to ZooKeeper 3.5.10 to address CVE-2020-10663
Jun 21, 2022
91741c0
Upgrade Jetty to 9.4.46.* to address CVE PRISMA-2021-0182
Jun 21, 2022
c6f25e1
Replace deprecated use of AllowSymLinkAliasChecker
Jun 23, 2022
9680abf
Merge branch 'feature/hadoop-18311-3.3.4' of github.pie.apple.com:IPR…
Jun 25, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 24 additions & 3 deletions hadoop-project/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@
<!--Whether to proceed to next module if any test failures exist-->
<maven.test.failure.ignore>true</maven.test.failure.ignore>
<maven.test.redirectTestOutputToFile>true</maven.test.redirectTestOutputToFile>
<jetty.version>9.4.43.v20210629</jetty.version>
<jetty.version>9.4.46.v20220331</jetty.version>
<test.exclude>_</test.exclude>
<test.exclude.pattern>_</test.exclude.pattern>

Expand Down Expand Up @@ -100,7 +100,7 @@
<hadoop-thirdparty-shaded-protobuf-prefix>${hadoop-thirdparty-shaded-prefix}.protobuf</hadoop-thirdparty-shaded-protobuf-prefix>
<hadoop-thirdparty-shaded-guava-prefix>${hadoop-thirdparty-shaded-prefix}.com.google.common</hadoop-thirdparty-shaded-guava-prefix>

<zookeeper.version>3.5.6</zookeeper.version>
<zookeeper.version>3.5.10</zookeeper.version>
<curator.version>4.2.0</curator.version>
<findbugs.version>3.0.5</findbugs.version>
<dnsjava.version>2.1.7</dnsjava.version>
Expand Down Expand Up @@ -187,7 +187,7 @@
<exec-maven-plugin.version>1.3.1</exec-maven-plugin.version>
<make-maven-plugin.version>1.0-beta-1</make-maven-plugin.version>
<surefire.fork.timeout>900</surefire.fork.timeout>
<aws-java-sdk.version>1.11.1026</aws-java-sdk.version>
<aws-java-sdk.version>1.12.243</aws-java-sdk.version>
<hsqldb.version>2.3.4</hsqldb.version>
<frontend-maven-plugin.version>1.11.2</frontend-maven-plugin.version>
<jasmine-maven-plugin.version>2.1</jasmine-maven-plugin.version>
Expand Down Expand Up @@ -1674,6 +1674,11 @@
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
</exclusion>
<!-- replace htrace-core with hbase-noop-htrace for CVE-2018-7489 -->
<exclusion>
<groupId>org.apache.htrace</groupId>
<artifactId>htrace-core</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -1691,6 +1696,11 @@
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
</exclusion>
<!-- replace htrace-core with hbase-noop-htrace for CVE-2018-7489 -->
<exclusion>
<groupId>org.apache.htrace</groupId>
<artifactId>htrace-core</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
Expand All @@ -1703,8 +1713,19 @@
<groupId>jdk.tools</groupId>
<artifactId>jdk.tools</artifactId>
</exclusion>
<!-- replace htrace-core with hbase-noop-htrace for CVE-2018-7489 -->
<exclusion>
<groupId>org.apache.htrace</groupId>
<artifactId>htrace-core</artifactId>
</exclusion>
</exclusions>
</dependency>
<!-- replace htrace-core with hbase-noop-htrace for CVE-2018-7489 -->
<dependency>
<groupId>org.apache.hbase.thirdparty</groupId>
<artifactId>hbase-noop-htrace</artifactId>
<version>4.1.0</version>
</dependency>
<dependency>
<groupId>org.apache.hbase</groupId>
<artifactId>hbase-server</artifactId>
Expand Down
6 changes: 6 additions & 0 deletions ...ect/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-timelineservice-hbase-tests/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,6 +214,12 @@
</exclusion>
</exclusions>
</dependency>
<!-- replace htrace-core with hbase-noop-htrace for CVE-2018-7489 -->
<dependency>
<groupId>org.apache.hbase.thirdparty</groupId>
<artifactId>hbase-noop-htrace</artifactId>
<scope>test</scope>
</dependency>

<dependency>
<groupId>org.apache.hbase</groupId>
Expand Down
5 changes: 5 additions & 0 deletions ...yarn-server-timelineservice-hbase/hadoop-yarn-server-timelineservice-hbase-client/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,11 @@
</exclusion>
</exclusions>
</dependency>
<!-- replace htrace-core with hbase-noop-htrace for CVE-2018-7489 -->
<dependency>
<groupId>org.apache.hbase.thirdparty</groupId>
<artifactId>hbase-noop-htrace</artifactId>
</dependency>

<dependency>
<groupId>org.apache.hbase</groupId>
Expand Down
5 changes: 5 additions & 0 deletions ...yarn-server-timelineservice-hbase/hadoop-yarn-server-timelineservice-hbase-common/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,11 @@
</exclusion>
</exclusions>
</dependency>
<!-- replace htrace-core with hbase-noop-htrace for CVE-2018-7489 -->
<dependency>
<groupId>org.apache.hbase.thirdparty</groupId>
<artifactId>hbase-noop-htrace</artifactId>
</dependency>

<dependency>
<groupId>org.apache.hadoop.thirdparty</groupId>
Expand Down
5 changes: 5 additions & 0 deletions ...er-timelineservice-hbase-server/hadoop-yarn-server-timelineservice-hbase-server-1/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,11 @@
</exclusion>
</exclusions>
</dependency>
<!-- replace htrace-core with hbase-noop-htrace for CVE-2018-7489 -->
<dependency>
<groupId>org.apache.hbase.thirdparty</groupId>
<artifactId>hbase-noop-htrace</artifactId>
</dependency>

<dependency>
<groupId>org.apache.hbase</groupId>
Expand Down
5 changes: 5 additions & 0 deletions ...er-timelineservice-hbase-server/hadoop-yarn-server-timelineservice-hbase-server-2/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,11 @@
</exclusion>
</exclusions>
</dependency>
<!-- replace htrace-core with hbase-noop-htrace for CVE-2018-7489 -->
<dependency>
<groupId>org.apache.hbase.thirdparty</groupId>
<artifactId>hbase-noop-htrace</artifactId>
</dependency>

<!-- This is to work around the version divergence of
org.jruby.jcodings:jcodings pulled in by hbase-client -->
Expand Down