[SPARK-38262] Upgrade Google guava to version 30.0-jre

• Type: Dependency upgrade
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 3.3.0
• Component/s: Build
• Assignee: Unassigned
• Reporter: Bjørn Jørgensen
• Created: 20/Feb/22 17:31
• Updated: 05/Apr/23 16:52
• Resolved: 16/Apr/22 21:01

Description

This is duplicated many times like in SPARK-32502

Apache Spark is using com.google.guava:guava version 14.0.1 which has two security issues.

CVE-2018-10237

CVE-2020-8908

We should upgrade to version 30.0

I will add some links to what I have found about this issue

HIVE-25617:fix bug introduced by CVE-2020-8908

Upgrade Guava to 27

HIVE-21961: Upgrade Hadoop to 3.1.4, Guava to 27.0-jre and Jetty to 9.4.20.v20190813

Shade Guava manually

[DISCUSS] Hadoop 3, dropping support for Hadoop 2.x

Issue Links

• links to: [Github] Pull Request #35584 (bjornjorgensen)
• links to: [Github] Pull Request #35584 (bjornjorgensen)