[HADOOP-18763] Upgrade aws-java-sdk to 1.12.367+

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.5
• Fix Version/s: 3.3.6
• Component/s: fs/s3
• Labels: pull-request-available
• Target Version/s: 3.3.6
• Assignee: Viraj Jasani
• Reporter: Steve Loughran
• Created: 09/Jun/23 10:50
• Updated: 21/Jan/24 01:08
• Resolved: 14/Jun/23 20:13

Description

aws sdk bundle < 1.12.367 uses a vulnerable versions of netty which is pulling in high severity CVE and creating unhappiness in security scans, even if s3a doesn't use that lib.

The safe version for netty is netty:4.1.86.Final and this is used by aws-java-adk:1.12.367+

Issue Links

• is depended upon by: HADOOP-18760 3.3.6 Release NOTICE and LICENSE file update
• is depended upon by: HADOOP-18765 Release 3.3.6
• links to: GitHub Pull Request #5741