[HADOOP-18468] upgrade jettison json jar due to fix CVE-2022-40149

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.10.2, 3.2.4, 3.3.4
• Fix Version/s: 3.4.0, 3.3.5
• Component/s: build
• Labels: pull-request-available
• Target Version/s: 3.4.0, 3.3.5
• Hadoop Flags: Reviewed
• Assignee: PJ Fanning
• Reporter: PJ Fanning
• Created: 25/Sep/22 16:30
• Updated: 27/Jan/24 09:13
• Resolved: 10/Oct/22 10:15

Description

A fix for https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40149

 

https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1

https://github.com/advisories/GHSA-56h3-78gp-v83r

Issue Links

• is duplicated by: HADOOP-18478 Upgrade jettison to 1.5.1 to mitigate CVE-2022-40149
• is related to: HADOOP-18587 upgrade to jettison 1.5.3 to fix CVE-2022-40150
• links to: GitHub Pull Request #4937
• links to: GitHub Pull Request #4985