Re: [I] Exclude jackson-databind from hudi-spark-bundle to fix CVE-2017-17485 [hudi]

["nsivabalan (via GitHub)" <gi...@apache.org>]

nsivabalan commented on issue #16618:
URL: https://github.com/apache/hudi/issues/16618#issuecomment-4795624039

   This appears to be resolved on current `master`:
   
   - `packaging/hudi-spark-bundle/pom.xml` uses an `<includes>` allow-list for the maven-shade-plugin (it doesn't use `<excludes>`). `jackson-databind` is not in that allow-list, so it is not bundled into `hudi-spark-bundle` regardless of transitive deps.
   - HBase (and its transitive HTrace dependency, which the original report identified as the source of the vulnerable `jackson-databind 2.4.0`) was fully removed in [HUDI-9020] / commit `09f9a16c2623` (May 2025).
   - Top-level `dependencyManagement` pins `jackson-databind` to `2.15.2` (Spark 3.5) / `2.17.1` (Spark 4), well above the version affected by CVE-2017-17485.
   
   If this is reproducing on a current build, please share the output of `mvn dependency:tree -pl packaging/hudi-spark-bundle` and the SCA scanner report so we can confirm. Otherwise, this can likely be closed as fixed.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org