[SPARK-34403] Remove dependency to commons-httpclient, is not used and has vulnerabilities.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 3.1.0
• Component/s: Spark Core
• Assignee: Unassigned
• Reporter: Sergio Sainz
• Created: 08/Feb/21 15:41
• Updated: 15/Jun/21 21:48
• Resolved: 12/Mar/21 19:42

Description

<dependency>
<groupId>commons-httpclient</groupId>
<artifactId>commons-httpclient</artifactId>
</dependency>

 

Has vulnerabilities as below:

 

CVE-2012-6153

CVE-2012-5783

 

Also, after removing it and running `spark/sql/hive$mvn compile test` the result is SUCCESS

 

Issue Links

• is duplicated by: SPARK-35429 Remove commons-httpclient due to EOL and CVEs
• links to: [Github] Pull Request #31528 (ssainz)
• links to: [Github] Pull Request #31528 (ssainz)