[HADOOP-18344] AWS SDK update to 1.12.262 to address jackson CVE-2018-7489 and AWS CVE-2022-31159

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.0, 3.3.4
• Fix Version/s: 3.4.0, 3.3.4
• Component/s: fs/s3
• Labels: pull-request-available
• Target Version/s: 3.4.0, 3.3.4
• Hadoop Flags: Reviewed
• Release Note: The AWS SDK has been updated to 1.12.262 to address jackson CVE-2018-7489
• Assignee: Steve Loughran
• Reporter: Steve Loughran
• Created: 18/Jul/22 11:06
• Updated: 28/Jan/24 00:24
• Resolved: 28/Jul/22 10:43

Description

The CVE CVE-2022-31159 is a vulnerability in path resolution in the AWS SDK transfer manager during downloads.

the s3a client is not exposed to this. it uses the class for local file upload and for object copying, but not download.

it may affect downstream use by other applications.

yet another jackson CVE in aws sdk
https://github.com/apache/hadoop/pull/4491/commits/5496816b472473eb7a9c174b7d3e69b6eee1e271

maybe we need to have a list of all shaded jackson's we get on the CP and have a process of upgrading them all at the same time

Issue Links

• is depended upon by: HADOOP-18393 Hadoop 3.3.2 has CVEs coming from dependencies
• is duplicated by: HADOOP-18350 Support for hadoop-aws with aws-java-sdk-bundle with version greater than 1.12.220
• is related to: SPARK-39969 Spark AWS SDK and kinesis dependencies lagging hadoop-aws and s3a
• relates to: HADOOP-18372 ILoadTestS3ABulkDeleteThrottling failing
• links to: GitHub Pull Request #4637
• links to: GitHub Pull Request #4645
• links to: GitHub Pull Request #4646