HADOOP-18323.Bump javax.ws.rs-api to 3.1.0 #4522
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
hotcodemacha
changed the title
Contributor
|
Can we wait sometime for HADOOP-15984 to go through? It will take sometime but if we can bump javax.ws.rs-api after Jersey 2 upgrade, that would be less complex. Otherwise we anyways have some complexities and some class clashes because jsr311-api is still being used, please check discussions on HADOOP-18033. cc @ayushtkn |
|
💔 -1 overall
This message was automatically generated. |
ayushtkn
requested changes
Jul 1, 2022
Member
ayushtkn
left a comment
ayushtkn
left a comment
There was a problem hiding this comment.
A lot of tests have failed as well....
But what is the CVE all about? are we getting impacted? This CVE is like "CVE from dependency", and the dependency is Junit? Can you check?
Some lines:
In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability
This vulnerability impacts you if the JUnit tests write sensitive information, like API keys or passwords, into the temporary folder, and the JUnit tests execute in an environment where the OS has other untrusted users.
For Java 1.7 and higher users: this vulnerability is fixed in 4.13.1
Doesn't look like a prod use case to me, second we are already above Juinit. 4.13.1
Contributor
Author
|
@ayushtkn @virajjasani - Thanks for your comments. I do agree after having all the test case failures and the fact that we are already on junit-4.13.1. It really don't look to me as Prod impacting vulnerability. |
Contributor
|
we don't distribute junit at all; sole risk would be during manual/automated builds |
Contributor
|
We're closing this stale PR because it has been open for 100 days with no activity. This isn't a judgement on the merit of the PR in any way. It's just a way of keeping the PR queue manageable. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of PR
Bump javax.ws.rs-api To Version 3.1.0 to mitigate CVE-2020-15250
JIRA - HADOOP-18323
How was this patch tested?
CI/Build
For code changes:
LICENSE,LICENSE-binary,NOTICE-binaryfiles?