[HADOOP-16542] Update commons-beanutils version to 1.9.4

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.0
• Fix Version/s: 3.3.0, 3.1.4, 3.2.2
• Labels: release-blocker
• Assignee: Kevin Su
• Reporter: Wei-Chiu Chuang
• Created: 03/Sep/19 13:32
• Updated: 27/Nov/23 09:48
• Resolved: 10/Sep/19 12:56

Description

http://mail-archives.apache.org/mod_mbox/www-announce/201908.mbox/[e-mail]%3e

 

CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in PropertyUtilsBean
by default.

Severity: Medium

Vendor: The Apache Software Foundation

Versions Affected: commons-beanutils-1.9.3 and earlier

Description: A special BeanIntrospector class was added in version 1.9.2.
This can be used to stop attackers from using the class property of
Java objects to get access to the classloader.
However this protection was not enabled by default.
PropertyUtilsBean (and consequently BeanUtilsBean) now disallows class
level property access by default, thus protecting against
CVE-2014-0114.

Mitigation: 1.X users should migrate to 1.9.4.

Issue Links

• relates to: HADOOP-12756 Incorporate Aliyun OSS file system implementation
• relates to: HADOOP-18991 Remove commons-beanutils dependency from Hadoop 3
• relates to: HADOOP-16588 Update commons-beanutils version to 1.9.4 in branch-2