[jira] [Resolved] (TEZ-4552) Upgrade protobuf to 3.24.4 due to CVE.

["László Bodor (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/TEZ-4552?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

László Bodor resolved TEZ-4552.
-------------------------------
    Resolution: Fixed

> Upgrade protobuf to 3.24.4 due to CVE.
> --------------------------------------
>
>                 Key: TEZ-4552
>                 URL: https://issues.apache.org/jira/browse/TEZ-4552
>             Project: Apache Tez
>          Issue Type: Improvement
>            Reporter: Shilun Fan
>            Assignee: Shilun Fan
>            Priority: Major
>             Fix For: 0.10.4
>
>          Time Spent: 2h 20m
>  Remaining Estimate: 0h
>
> I found that there are 3 CVE issues that we need to deal with. These CVE issues are related to protobuf. Our protobuf uses 3.21.1, which is an old version. This PR will try to upgrade the protobuf version to solve the CVE issue.
>  * [CVE-2022-3171|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3171]
>  * [CVE-2022-3509|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3509]
>  * [CVE-2022-3510|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3510]



--
This message was sent by Atlassian Jira
(v8.20.10#820010)