[HADOOP-15299] Bump Hadoop's Jackson 2 dependency 2.9.x

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.0, 3.2.0
• Fix Version/s: 3.2.0
• Target Version/s: 3.2.0
• Assignee: Sean Mackrory
• Reporter: Sean Mackrory
• Created: 08/Mar/18 19:55
• Updated: 16/Apr/18 15:03
• Resolved: 26/Mar/18 22:48

Description

There are a few new CVEs open against Jackson 2.7.x. It doesn't (necessarily) mean Hadoop is vulnerable to the attack - I don't know that it is, but fixes were released for Jackson 2.8.x and 2.9.x but not 2.7.x (which we're on). We shouldn't be on an unmaintained line, regardless. HBase is already on 2.9.x, we have a shaded client now, the API changes are relatively minor and so far in my testing I haven't seen any problems. I think many of our usual reasons to hesitate upgrading this dependency don't apply.

Issue Links

• causes: HADOOP-15389 Hadoop contains both Jackson 2.9.4 and 2.7.8 jars
• is depended upon by: HADOOP-9991 Fix up Hadoop POMs, roll up JARs to latest versions