-
Notifications
You must be signed in to change notification settings - Fork 4.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
HIVE-25054: (2.3) Drop vulnerable jodd-core dependency #5151
Conversation
@@ -1119,6 +1118,7 @@ | |||
<exclude>**/*.html</exclude> | |||
<exclude>**/sit</exclude> | |||
<exclude>**/test/queries/**/*.sql</exclude> | |||
<exclude>**/ql/io/parquet/timestamp/datetime/**</exclude> |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
according to https://www.apache.org/legal/src-headers.html#3party, we should not add AL2 license header to the copied source files
e02f7fe
to
8959bc0
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Thanks for your approval, @sunchao |
Thanks @pan3793 ! |
### What changes were proposed in this pull request? Remove a jar that has CVE GHSA-jrg3-qq99-35g7 ### Why are the changes needed? Previously, `jodd-core` came from Hive transitive deps, while apache/hive#5151 (Hive 2.3.10) cut it out, so we can remove it from Spark now. ### Does this PR introduce _any_ user-facing change? No ### How was this patch tested? Pass GA. ### Was this patch authored or co-authored using generative AI tooling? No. Closes #46520 from pan3793/SPARK-48230. Authored-by: Cheng Pan <chengpan@apache.org> Signed-off-by: Dongjoon Hyun <dhyun@apple.com>
### What changes were proposed in this pull request? Remove a jar that has CVE GHSA-jrg3-qq99-35g7 ### Why are the changes needed? Previously, `jodd-core` came from Hive transitive deps, while apache/hive#5151 (Hive 2.3.10) cut it out, so we can remove it from Spark now. ### Does this PR introduce _any_ user-facing change? No ### How was this patch tested? Pass GA. ### Was this patch authored or co-authored using generative AI tooling? No. Closes apache#46520 from pan3793/SPARK-48230. Authored-by: Cheng Pan <chengpan@apache.org> Signed-off-by: Dongjoon Hyun <dhyun@apple.com>
What changes were proposed in this pull request?
This is an alternative to #4923 to address jodd CVE.
Hive uses jodd's JDateTime to handle Julian's calendar in processing Parquet timestamp, while the calendar is tricky and bugly stuff, considering that branch-2.3 has been in maintaining mode for a long time, I prefer to copy the corresponding code to avoid involving any unexpected behavior change.
Why are the changes needed?
To address CVE-2018-21234.
Jodd CVE is listed in https://issues.apache.org/jira/browse/SPARK-44757 top 1, with a score 9.8.
Does this PR introduce any user-facing change?
No.
Is the change a dependency upgrade?
No.
How was this patch tested?
UT