[SPARK-13471] Upgrade spark-project hive 1.2.1 jar to one with a groovy 2.4.4 dependency

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 1.6.0
• Component/s: SQL
• Assignee: Unassigned
• Reporter: Steve Loughran
• Created: 24/Feb/16 12:06
• Updated: 01/Mar/16 18:23
• Resolved: 01/Mar/16 18:23

Description

The version of groovy that Hive 1.2.1 is built with contains a serialization vulnerability,

While this shouldn't expose Spark to any attacks (it doesn't need the groovy artifacts to work), the POMs may still export that transitive groovy dependency.

Fix: declare that org.spark-project.hive depends on groovy 2.4.4, rebuild and republish, update spark dependencies to new version

Issue Links

• is superceded by: SPARK-13599 Groovy-all ends up in spark-assembly if hive profile set
• links to: [Github] Pull Request #11346 (steveloughran)
• links to: [Github] Pull Request #11446 (steveloughran)