[HADOOP-18212] hadoop-client-runtime latest version 3.3.2 has security issues

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 3.3.2
• Fix Version/s: 3.3.3
• Component/s: build
• Assignee: Unassigned
• Reporter: phoebe chen
• Created: 19/Apr/22 23:19
• Updated: 19/May/22 02:54
• Resolved: 20/Apr/22 11:36

Description

Currently in highest version of hadoop-client-runtime 3.3.2, there are following security vulnerabilities comes from dependencies:

com.fasterxml.jackson.core_jackson-databind in version 2.13.0, per [CVE-2020-36518|https://nvd.nist.gov/vuln/detail/CVE-2020-36518,] need to be upgraded to 2.13.2.2.

commons-codec_commons-codec in version 1.11 per CODEC-134, need to be upgraded to 1.13 or higher

Thanks.

Issue Links

• duplicates: HADOOP-18178 Upgrade jackson to 2.13.2 and jackson-databind to 2.13.2.2. CVE-2020-36518
• duplicates: HADOOP-17341 Upgrade commons-codec to 1.15
• Is contained by: HADOOP-18198 Release Hadoop 3.3.3: hadoop-3.3.2 with some fixes