[HADOOP-18496] upgrade kotlin-stdlib due to CVEs

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Labels: pull-request-available
• Assignee: Unassigned
• Reporter: PJ Fanning
• Created: 13/Oct/22 18:54
• Updated: 13/Sep/23 16:41

Description

I'm not an expert on Kotlin but dependabot show these 2 CVEs with the version of kotlin-stdlib used in Hadoop.

• https://github.com/advisories/GHSA-cqj8-47ch-rvvq
• https://github.com/advisories/GHSA-2qp4-g3q3-f92w

kotlin-stlib 1.6.0 is the minimum version needed to fix both. It might be better to use latest v1.6 jar (currently 1.6.21) or even use latest jar altogether (currently 1.7.20).

 

Issue Links

• is depended upon by: HADOOP-18837 Upgrade Okio to 3.4.0 due to CVE-2023-3635
• is related to: HADOOP-18890 remove okhttp usage
• links to: GitHub Pull Request #5035
• links to: GitHub Pull Request #5139
• links to: GitHub Pull Request #5140
• links to: GitHub Pull Request #6057