HIVE-25054: (2.3) Upgrade jodd-core dependency to get rid of CVE-2018-21234
#4923
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
LuciferYang
approved these changes
Dec 7, 2023
asf-ci-hive
added
tests failed
tests pending
and removed
tests pending
tests failed
labels
sunchao
approved these changes
Dec 8, 2023
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. |
the reason for my preference of copying rather than upgrading jodd is, that new jodd changed the calculation to use Java 8 Time API, I'm not sure if this will bring behavior change or not. |
asf-ci-hive
added
tests failed
tests pending
and removed
tests pending
tests failed
labels
… (Abhay Chennagiri, reviewed by Jesus Camacho Rodriguez) Closes apache#2217
6 tasks
|
Close and in favor #5151 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Backport HIVE-25054 to branch-2.3, to address CVE-2018-21234.
Why are the changes needed?
jodd CVE is listed in https://issues.apache.org/jira/browse/SPARK-44757 in first place, with score 9.8.
Although I prefer to get rid of such dependency by #4888, but it is objected by the Hive community (please let me know if we can do it in branch-2.3)
Does this PR introduce any user-facing change?
No. (but the jodd APIs used by Hive are changed, it's a potential breaking change of the downstream project which consumes Hive and jodd API directly)
Is the change a dependency upgrade?
Yes, the upgraded jar has zero-deps, but itself name changed
How was this patch tested?
Pass GA.