Details
-
Task
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
3.4.0
-
Reviewed
Description
When hadoop common is pulled in outside of hadoop project, the wrong version of jettison is coming as the dependency management of hadoop-project doesn't apply this case.
So it's not enough just to upgrade the version in dependency management. When jettison is coming only as transitive, whoever is pulling in that hadoop library, will still get the wrong jettison.
example:
hadoop-common
org.example:untitled:jar:1.0-SNAPSHOT \- org.apache.hadoop:hadoop-common:jar:3.4.0-SNAPSHOT:compile ... +- com.github.pjfanning:jersey-json:jar:1.20:compile | +- org.codehaus.jettison:jettison:jar:1.1:compile ...
When the module is a library (so it will be used outside of the actual project), the correct dependency must be declared as direct dependency (and optionally excluding from the dependency where it came from originally).
jettison should be added as direct dependency
Attachments
Issue Links
- relates to
-
HADOOP-18587 upgrade to jettison 1.5.3 to fix CVE-2022-40150
-
- Resolved
-
- links to