[AVRO-3111] Update Hadoop versions to prevent false-positive security reports

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.10.1, 1.10.2
• Fix Version/s: 1.11.0
• Component/s: java

Environment

Docker image built on library/buildpack-deps:buster-curl (buildpack-deps (docker.com))

• Assignee: Ismaël Mejía
• Reporter: David L. Day
• Created: 15/Apr/21 19:37
• Updated: 22/Nov/21 18:56
• Resolved: 16/Apr/21 14:18

Description

When installing avro-tools in a container on a debian image, my company's image scanner reports CVE-2019-17195:

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

I see other Apache projects have had this CVE reported and have been fixed, but did not see where this was reported for Apache Avro Tools specifically.

Issue Links

• is duplicated by: AVRO-3151 Black Duck SEV-4 issue "Improper Check for Unusual or Exceptional Conditions" for Apache Avro 1.10.2
• is related to: HADOOP-16690 Update dependency com.nimbusds:nimbus-jose-jwt due to security vulnerability
• links to: CVE-2019-17195
• links to: GitHub Pull Request #1188
• links to: https://github.com/apache/avro/pull/1007