[HDFS-16777] datatables@1.10.17 sonatype-2020-0988 vulnerability

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.4
• Fix Version/s: 3.4.0
• Component/s: ui
• Labels: pull-request-available
• Target Version/s: 3.4.0
• Hadoop Flags: Reviewed
• Assignee: Ashutosh Gupta
• Reporter: Eugene Shinn (Truveta)
• Created: 19/Sep/22 17:06
• Updated: 28/Jan/24 08:03
• Resolved: 12/Oct/22 21:51

Description

Our static analysis security tool detected that HDFS's UI currently includes a vulnerable version of datatables detected by Sonatype (sonatype-2020-0988). 

From the vulnerability description:

"The `datatables.net` package is vulnerable to Prototype Pollution. The `setData` function in `jquery.dataTables.js` fails to protect prototype attributes when objects are created during the application's execution. A remote attacker can exploit this to modify the behavior of object prototypes which, depending on their use in the application, may result in a Denial of Service (DoS), Remote Code Execution (RCE), or other unexpected execution flow."

This issue was addressed in v 1.11.5 (ref: Fix: Protect developers from inadvertantely introducing prototype pol… · DataTables/Dist-DataTables@e2e19ea (github.com)).

N.B. this issue was also detected within the YARN UI as well.

Issue Links

• links to: GitHub Pull Request #5003