[HADOOP-18069] CVE-2021-0341 in okhttp@2.7.5 detected in hdfs-client

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 3.3.1
• Component/s: hdfs-client
• Labels: pull-request-available
• Assignee: Ashutosh Gupta
• Reporter: Eugene Shinn (Truveta)
• Created: 05/Jan/22 19:47
• Updated: 23/Aug/22 11:58
• Resolved: 22/Apr/22 09:57

Description

Our static vulnerability scanner (Fortify On Demand) detected NVD - CVE-2021-0341 (nist.gov) in our application. We traced the vulnerability to a transitive dependency coming from hadoop-hdfs-client, which depends on okhttp@2.7.5 (hadoop/pom.xml at trunk · apache/hadoop (github.com)). To resolve this issue, okhttp should be upgraded to 4.9.2+ (ref: CVE-2021-0341 · Issue #6724 · square/okhttp (github.com)).

Issue Links

• duplicates: HDFS-16453 Upgrade okhttp from 2.7.5 to 4.9.3
• links to: GitHub Pull Request #4229