[HADOOP-18148] json smart 1.3.2 still appears in Trivy scan of build

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.3.2
• Component/s: common
• Assignee: Unassigned
• Reporter: Fred Purcell
• Created: 28/Feb/22 15:42
• Updated: 01/Mar/23 18:42

Description

when building 3.3.2 Hadoop is still failing CVE scans showing the following error. We are unable to use Hadoop with this CVE showing

 
"VulnerabilityID": "CVE-2021-31684",
"PkgName": "net.minidev:json-smart",
"PkgPath": "...lib/org.apache.hadoop.hadoop-client-runtime-3.3.2.jar",
"InstalledVersion": "1.3.2",
"FixedVersion": "2.4.5, 1.3.3",

 

more specifically

 
"VulnerabilityID": "CVE-2021-31684",
"PkgName": "net.minidev:json-smart",
"PkgPath": ".../lib/com.nimbusds.nimbus-jose-jwt-9.8.1.jar",
"InstalledVersion": "1.3.2",
"FixedVersion": "2.4.5, 1.3.3",