[HADOOP-18561] CVE-2021-37533 on commons-net is included in hadoop common and hadoop-client-runtime

• Type: Improvement
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 3.3.5, 3.3.4
• Fix Version/s: 3.4.0, 3.3.5
• Component/s: build
• Labels: pull-request-available transitive-cve
• Target Version/s: 3.3.9
• Hadoop Flags: Reviewed
• Assignee: Steve Loughran
• Reporter: phoebe chen
• Created: 06/Dec/22 18:28
• Updated: 27/Jan/24 09:01
• Resolved: 19/Dec/22 11:25

Description

Latest 3.3.4 version of hadoop-common and hadoop-client-runtime includes commons-net in version 3.6, which has vulnerability CVE-2021-37533. Need to upgrade it to 3.9 to fix.

This is a due diligence patch only; by the time the caller encounters the CVE they must have already provided their username and password to a malicious ftp server.

Issue Links

• relates to: NET-711 Add FTP option to toggle use of return host like cURL
• relates to: HADOOP-18361 Update commons-net from 3.6 to 3.8.0.
• links to: GitHub Pull Request #5214
• links to: GitHub Pull Request #5227
• links to: GitHub Pull Request #5228