[AMBARI-24450] Remove dependencies with potential security vulnerabilities from fast-hdfs-resource - ASF JIRA

Attach files

Attach Screenshot

Voters

Watch issue

Watchers

Create sub-task

Link

Clone

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: Bug
Status: Resolved
Priority: Blocker
Resolution: Fixed
Affects Version/s: 2.7.1
Fix Version/s: 2.7.1
Component/s: ambari-server
Labels:
- pull-request-available

Description

Remove dependencies with potential security vulnerabilities from fast-hdfs-resource. Most issues appear to be coming from dependencies of org.apache.hadoop:hadoop-core:1.2.1.

Apache Tomcat 5.5.12 - recommendation, exclude or update to 6.0.20.0 or above.

[INFO] ------------------------------------------------------------------------
[INFO] Building fast-hdfs-resource 0.0.1-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ fast-hdfs-resource ---
[INFO] org.apache.ambari:fast-hdfs-resource:jar:0.0.1-SNAPSHOT
[INFO] \- org.apache.hadoop:hadoop-core:jar:1.2.1:compile
[INFO]    +- tomcat:jasper-runtime:jar:5.5.12:compile
[INFO]    \- tomcat:jasper-compiler:jar:5.5.12:compile
[INFO] ------------------------------------------------------------------------

org.mortbay.jetty:jetty:6.1.26 - exclude or update to 6.1.26-hwx
org.mortbay.jetty:jsp-2.1:6.1H.14.1 - exclude or update to 6.1.0.0-fuse
org.mortbay.jetty:servlet-api-2.5:6.1.12rc1 - exclude or update to 6.1.0.1-fuse

org.mortbay.jetty:jetty-test:6.1.26 - exclude or update to 6.1.26.hwx

[INFO] ------------------------------------------------------------------------
[INFO] Building fast-hdfs-resource 0.0.1-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO]
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ fast-hdfs-resource ---
[INFO] org.apache.ambari:fast-hdfs-resource:jar:0.0.1-SNAPSHOT
[INFO] \- org.apache.hadoop:hadoop-core:jar:1.2.1:compile
[INFO]    +- org.mortbay.jetty:jetty:jar:6.1.26:compile
[INFO]    |  \- org.mortbay.jetty:servlet-api:jar:2.5-20081211:compile
[INFO]    +- org.mortbay.jetty:jetty-util:jar:6.1.26:compile
[INFO]    +- org.mortbay.jetty:jsp-api-2.1:jar:6.1.14:compile
[INFO]    |  \- org.mortbay.jetty:servlet-api-2.5:jar:6.1.14:compile
[INFO]    \- org.mortbay.jetty:jsp-2.1:jar:6.1.14:compile
[INFO] ------------------------------------------------------------------------