Details
-
Improvement
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
3.4.0, 3.3.5
-
Incompatible change
-
Description
hadoop-auth has a dependency on net.minidev:json-smart 2.4.7, but this dependency is never used.
This dependency was originally included because the transitive dependency that nimbus-jose-jwt had did not work properly (see https://issues.apache.org/jira/browse/HADOOP-14903). Since version 9.* nimbus-jose-jwt is using its own shaded version of json-smart, so the version declared in hadoop-auth is never actually used.
json-smart 2.4.7 shows up in CVE scans for CVE-2023-1370. It is still used as a transitive dependency in hadoop-hdfs
Attachments
Issue Links
- relates to
-
HADOOP-14903 Add json-smart explicitly to pom.xml
-
- Resolved
-
- links to