[HADOOP-18311] Upgrade dependencies to address several CVEs

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.3.3, 3.3.4
• Component/s: common
• Labels: pull-request-available
• Target Version/s: 3.3.9
• Assignee: Unassigned
• Reporter: Steve Vaughan
• Created: 22/Jun/22 14:08
• Updated: 12/Jun/23 21:55

Description

The following CVEs can be addressed by upgrading dependencies within the build.  This includes a replacement of HTrace with a noop implementation.

• CVE-2018-7489
• CVE-2020-10663
• CVE-2020-28491
• CVE-2020-35490
• CVE-2020-35491
• CVE-2020-36518
• PRISMA-2021-0182

This addresses all of the CVEs from 3.3.3 except for ones that would require upgrading Netty to 4.x.  I'll be submitting a pull request for 3.3.4.

Issue Links

• is a parent of: YARN-11199 Replace htrace-core with hbase-noop-htrace for CVE-2018-7489, CVE-2020-35491, CVE-2020-35490, and CVE-2020-36518
• is depended upon by: HADOOP-18305 Release Hadoop 3.3.4: minor update of hadoop-3.3.3
• links to: GitHub Pull Request #4490
• links to: GitHub Pull Request #4491