[HIVE-12469] Bump Commons-Collections dependency from 3.2.1 to 3.2.2. to address vulnerability

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 1.2.1
• Fix Version/s: 1.3.0, 2.0.0
• Component/s: Build Infrastructure
• Target Version/s: 1.2.2, 2.0.0
• Assignee: Ashutosh Chauhan
• Reporter: Reuben Kuhnert
• Created: 19/Nov/15 16:39
• Updated: 17/Mar/17 20:43
• Resolved: 02/Dec/15 16:47

Description

Currently the commons-collections (3.2.1) library allows for invocation of arbitrary code through InvokerTransformer, need to bump the version of commons-collections from 3.2.1 to 3.2.2 to resolve this issue.

Results of mvn dependency:tree:

[INFO] ------------------------------------------------------------------------
[INFO] Building Hive HPL/SQL 2.0.0-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO] 
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ hive-hplsql ---
[INFO] org.apache.hive:hive-hplsql:jar:2.0.0-SNAPSHOT
[INFO] +- com.google.guava:guava:jar:14.0.1:compile
[INFO] +- commons-collections:commons-collections:jar:3.2.1:compile

[INFO] ------------------------------------------------------------------------
[INFO] Building Hive Packaging 2.0.0-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO] +- org.apache.hive:hive-hbase-handler:jar:2.0.0-SNAPSHOT:compile
[INFO] |  +- org.apache.hbase:hbase-server:jar:1.1.1:compile
[INFO] |  |  +- commons-collections:commons-collections:jar:3.2.1:compile

[INFO] ------------------------------------------------------------------------
[INFO] Building Hive Common 2.0.0-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO] 
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ hive-common ---
[INFO] +- org.apache.hadoop:hadoop-common:jar:2.6.0:compile
[INFO] |  +- commons-collections:commons-collections:jar:3.2.1:compile

Hadoop-Common dependency also found in: LLAP, Serde, Storage, Shims, Shims Common, Shims Scheduler)

[INFO] ------------------------------------------------------------------------
[INFO] Building Hive Ant Utilities 2.0.0-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO] 
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ hive-ant ---
[INFO] |  +- commons-collections:commons-collections:jar:3.1:compile

[INFO]                                                                         
[INFO] ------------------------------------------------------------------------
[INFO] Building Hive Accumulo Handler 2.0.0-SNAPSHOT
[INFO] ------------------------------------------------------------------------
[INFO] +- org.apache.accumulo:accumulo-core:jar:1.6.0:compile
[INFO] |  +- commons-collections:commons-collections:jar:3.2.1:compile

Issue Links

• links to: Collections-580
• links to: Hadoop-12577