[HADOOP-14100] Upgrade Jsch jar to latest version to fix vulnerability in old versions

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.7.3, 2.6.5
• Fix Version/s: 2.9.0, 2.7.4, 3.0.0-alpha4, 2.8.2
• Target Version/s: 2.7.4
• Hadoop Flags: Reviewed
• Assignee: Vinayakumar B
• Reporter: Vinayakumar B
• Created: 21/Feb/17 06:05
• Updated: 25/Feb/19 06:08
• Resolved: 09/May/17 16:49

Description

Recently there was on vulnerability reported on jsch library. Its fixed in latest 0.1.54 version before CVE was made public.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5725

So, need to upgrade jsch to latest 0.1.54 version.

Issue Links

• causes: HADOOP-15900 Update JSch versions in LICENSE.txt
• is depended upon by: HADOOP-9991 Fix up Hadoop POMs, roll up JARs to latest versions
• is duplicated by: HDFS-14309 name node fail over failed with ssh fence failed because of jsch login failed with key check
• relates to: HADOOP-11515 Upgrade jsch lib to jsch-0.1.51 to avoid problems running on java7