[HADOOP-18341] upgrade commons-configuration2 to 2.8.0 and commons-text to 1.9

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.0, 3.3.5
• Fix Version/s: 3.4.0, 3.3.5, 3.2.5
• Component/s: common
• Labels: pull-request-available
• Target Version/s: 3.4.0, 3.3.5
• Hadoop Flags: Reviewed
• Assignee: PJ Fanning
• Reporter: PJ Fanning
• Created: 18/Jul/22 09:28
• Updated: 28/Jan/24 00:25
• Resolved: 22/Sep/22 02:15

Description

Current version 2.1.1 has no CVEs but all higher versions have CVEs except for the latest release 2.8.0. Still feels like it would be safer to upgrade.

Currently, causes issues - that will need to be fixed:

```
[ERROR] testBlockReaderLocalWithMlockChanges(org.apache.hadoop.hdfs.client.impl.TestBlockReaderLocal) Time elapsed: 0.414 s <<< ERROR!
java.lang.NoClassDefFoundError: Could not initialize class org.apache.commons.configuration2.interpol.ConfigurationInterpolator$DefaultPrefixLookupsHolder
at org.apache.commons.configuration2.interpol.ConfigurationInterpolator.getDefaultPrefixLookups(ConfigurationInterpolator.java:290)
at org.apache.commons.configuration2.AbstractConfiguration.installDefaultInterpolator(AbstractConfiguration.java:375)
at org.apache.commons.configuration2.AbstractConfiguration.<init>(AbstractConfiguration.java:122)
at org.apache.commons.configuration2.BaseConfiguration.<init>(BaseConfiguration.java:37)
at org.apache.commons.configuration2.PropertiesConfiguration.<init>(PropertiesConfiguration.java:1059)
at org.apache.hadoop.metrics2.impl.MetricsConfig.loadFirst(MetricsConfig.java:114)
at org.apache.hadoop.metrics2.impl.MetricsConfig.create(MetricsConfig.java:97)
at org.apache.hadoop.metrics2.impl.MetricsSystemImpl.configure(MetricsSystemImpl.java:482)
at org.apache.hadoop.metrics2.impl.MetricsSystemImpl.start(MetricsSystemImpl.java:188)
at org.apache.hadoop.metrics2.impl.MetricsSystemImpl.init(MetricsSystemImpl.java:163)
at org.apache.hadoop.metrics2.lib.DefaultMetricsSystem.init(DefaultMetricsSystem.java:62)
at org.apache.hadoop.metrics2.lib.DefaultMetricsSystem.initialize(DefaultMetricsSystem.java:58)
at org.apache.hadoop.hdfs.server.namenode.NameNode.createNameNode(NameNode.java:1780)
```

Issue Links

• is related to: HADOOP-18492 upgrade commons-text to 1.10.0
• is related to: HADOOP-18497 Upgrade commons-text version to fix CVE-2022-42889
• relates to: PHOENIX-7181 Do not declare commons-configuration2 dependency
• links to: GitHub Pull Request #4578
• links to: GitHub Pull Request #4916
• links to: GitHub Pull Request #4920