[HUDI-8402] Fix for CVE-2023-39410 and CVE-2020-13956#12010
[HUDI-8402] Fix for CVE-2023-39410 and CVE-2020-13956#12010danny0405 merged 2 commits intoapache:branch-0.xfrom
Conversation
| <hudi.spark.common.modules.1>hudi-spark3-common</hudi.spark.common.modules.1> | ||
| <hudi.spark.common.modules.2>hudi-spark3.2plus-common</hudi.spark.common.modules.2> | ||
| <avro.version>1.8.2</avro.version> | ||
| <avro.version>1.11.3</avro.version> |
There was a problem hiding this comment.
Not sure whether spark-avro work with this, since 1.9, avro introduces many breaking change in their API.
There was a problem hiding this comment.
@danny0405 any specific workaround to verify if spark-avro is compatible and works fine with avro 1.11.3.
There was a problem hiding this comment.
We have deprecated Spark 2, 3.0 - 3.2 support, and the minimum Avro version used in Spark is 1.11.2. So I think this should be fine.
There was a problem hiding this comment.
then we are fine, Flink also uses avro 1.11+
hudi-common/pom.xml
Outdated
| <dependency> | ||
| <groupId>org.apache.httpcomponents</groupId> | ||
| <artifactId>httpclient</artifactId> | ||
| <version>4.5.13</version> |
There was a problem hiding this comment.
Only change the version in root POM.
| <hudi.spark.common.modules.1>hudi-spark3-common</hudi.spark.common.modules.1> | ||
| <hudi.spark.common.modules.2>hudi-spark3.2plus-common</hudi.spark.common.modules.2> | ||
| <avro.version>1.8.2</avro.version> | ||
| <avro.version>1.11.3</avro.version> |
There was a problem hiding this comment.
We have deprecated Spark 2, 3.0 - 3.2 support, and the minimum Avro version used in Spark is 1.11.2. So I think this should be fine.
danny0405
changed the title
4 participants
Upgrade httpclient version to 4.5.13
Upgrade avro version to 1.11.3
Reference PR - #11964
Change Logs
This issue will address the below CVE from hudi-presto-bundle:0.14.0 jar
https://nvd.nist.gov/vuln/detail/CVE-2023-39410
https://nvd.nist.gov/vuln/detail/CVE-2020-13956
Impact
No user facing impacts
Risk level (write none, low medium or high below)
Included the new changes in presto and we haven't seen any regression issues
Documentation Update
None
Contributor's checklist