[HIVE-24788] Backport HIVE-23338 to branch-3.1

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.1.3
• Labels: pull-request-available
• Assignee: H. Vetinari
• Reporter: H. Vetinari
• Created: 16/Feb/21 15:49
• Updated: 02/Apr/23 19:49
• Resolved: 24/Feb/21 11:57

Description

jackson has a whole bunch of CVEs open against 2.9.x, which makes working with HIVE in security aware environments quite difficult.

This has been fixed in HIVE-23338 already, but since 4.0.0 hasn't been released yet (and is not on the horizon, as far as I can tell), this should be backported to branch-3.1.

Issue Links

• relates to: HADOOP-16905 Update jackson-databind to 2.10.3 to relieve us from the endless CVE patches
• relates to: HIVE-27210 Backport HIVE-23338: Bump jackson version to 2.10.0 in branch-3
• relates to: HADOOP-16917 Update dependency in branch-3.1
• relates to: HIVE-23338 Bump jackson version to 2.10.0
• links to: GitHub Pull Request #1986