[HIVE-25054] Upgrade jodd-core due to CVE-2018-21234

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.3.10, 4.0.0-alpha-1
• Component/s: Build Infrastructure
• Labels: pull-request-available
• Assignee: Abhay
• Reporter: Abhay
• Created: 23/Apr/21 16:15
• Updated: 16/May/24 07:10
• Resolved: 21/May/21 19:21

Description

Hive makes use of 3.5.2 version of the `jodd-core` library which is susceptible to CVE-2018-21234. Below is a description of that vulnerability.
CVE-2018-21234 suppress

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
CWE-502 Deserialization of Untrusted Data

CVSSv2:
Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C/I/A
CVSSv3:
Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:
MISC - https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16MISC - https://github.com/oblac/jodd/compare/v5.0.3...v5.0.4MISC - https://github.com/oblac/jodd/issues/628Vulnerable Software & Versions:
cpe:2.3:a:jodd:jodd:::::::: versions up to (excluding) 5.0.4
 

This library needs to be upgraded. We use a couple of classes `JDateTime`(https://github.infra.cloudera.com/CDH/hive/blob/cdpd-master/ql/src/java/org/apache/hadoop/hive/ql/io/parquet/timestamp/NanoTimeUtils.java ) and `HtmlEncoder`, which have either been deprecated and/or have been moved to a different package called jodd-util.

 

Issue Links

• causes: HIVE-28249 Parquet legacy timezone conversion converts march 1st to 29th feb and fails with not a leap year exception
• links to: GitHub Pull Request #4923
• links to: GitHub Pull Request #5151
• links to: PR-2217