Currently most Hive version depends on commons-compress 1.9 or 1.4. Those versions have several security issues: https://commons.apache.org/proper/commons-compress/security-reports.html
I propose to upgrade all commons-compress dependencies in all Hive (sub-)projects to at least 1.18. This will also make it easier for future extensions to Hive (serde, udfs, etc.) that have dependencies to commons-compress (e.g. https://github.com/zuinnote/hadoopoffice/wiki) to integrate into Hive without upgrading the commons-compress library manually in the Hive lib folder.