[SPARK-39020] [CVE-2020-9480] Transitive dependency "unused" from spark-sql_2.12 highlight as vulnerable in dependency tracker

• Type: Question
• Status: Resolved
• Priority: Minor
• Resolution: Not A Problem
• Affects Version/s: 3.2.1
• Component/s: Spark Core

Language

java

• Assignee: Unassigned
• Reporter: Sundar
• Created: 26/Apr/22 07:04
• Updated: 14/Jun/22 00:31
• Resolved: 14/Jun/22 00:31

Description

I am using spark-sql_2.12 dependency version 3.2.1 in my project. My dependency tracker highlights  the transitive dependency  "unused"  from  spark-sql_2.12 as vulnerable. I check there is no update for this artifacts since 2014. Is the artifact used anywhere in spark ?

To resolve this vulnerability,  can I exclude this "unused" artifact from spark-sql_2.12 ?  Will it cause any issues in my project ?