[SPARK-37090] Upgrade libthrift to resolve security vulnerabilities

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 3.0.0, 3.1.0, 3.2.0, 3.3.0
• Component/s: SQL
• Assignee: Unassigned
• Reporter: Juliusz Sompolski
• Created: 21/Oct/21 19:58
• Updated: 10/May/24 04:36
• Resolved: 10/May/24 04:36

Description

Currently, Spark uses libthrift 0.12, which has reported high severity security vulnerabilities https://snyk.io/vuln/maven:org.apache.thrift%3Alibthrift
Upgrade to 0.14 to get rid of vulnerabilities.

Issue Links

• is blocked by: HIVE-21498 Upgrade Thrift to 0.13.0
• is blocked by: HIVE-25098 [CVE-2020-13949] Upgrade thrift from 0.13.0 to 0.14.1
• is duplicated by: SPARK-36994 Upgrade Apache Thrift
• is duplicated by: SPARK-37626 Upgrade libthrift to 0.15.0
• is related to: SPARK-47018 Upgrade built-in Hive to 2.3.10
• is superceded by: SPARK-47018 Upgrade built-in Hive to 2.3.10
• links to: [Github] Pull Request #34361 (juliuszsompolski)
• links to: [Github] Pull Request #34362 (wangyum)
• links to: [Github] Pull Request #35587 (wangyum)
• links to: [Github] Pull Request #35587 (wangyum)
• links to: [Github] Pull Request #35588 (wangyum)
• links to: [Github] Pull Request #35646 (wangyum)
• links to: [Github] Pull Request #35646 (wangyum)
• links to: [Github] Pull Request #35647 (wangyum)
• links to: [Github] Pull Request #35647 (wangyum)