[SOLR-15355] CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 8.6, 8.6.2
• Fix Version/s: 8.10
• Component/s: hdfs, security
• Assignee: Unassigned
• Reporter: Nazerke Seidan
• Created: 19/Apr/21 16:04
• Updated: 20/Jan/22 18:40
• Resolved: 16/Oct/21 03:48

Description

CVE-2020-9492 vuln. issue is found in 8x component maven:org.apache.hadoop:hadoop-hdfs-client (version3.2.0) It seems with the version 3.2.0 hdfs client might send authorization header to remote url without verification. (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9492)

Issue Links

• is related to: SOLR-15942 Upgrade Hadoop to 3.3.1
• links to: GitHub Pull Request #2520