You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@hive.apache.org by "Akanksha kedia (Jira)" <ji...@apache.org> on 2026/09/24 05:25:00 UTC

[jira] [Assigned] (HIVE-30093) Upgrade parquet-hadoop-bundle to remediate transitive Jackson-databind vulnerabilities

     [ https://issues.apache.org/jira/browse/HIVE-30093?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Akanksha kedia reassigned HIVE-30093:
-------------------------------------

    Assignee: Akanksha kedia

> Upgrade parquet-hadoop-bundle to remediate transitive Jackson-databind vulnerabilities
> --------------------------------------------------------------------------------------
>
>                 Key: HIVE-30093
>                 URL: https://issues.apache.org/jira/browse/HIVE-30093
>             Project: Hive
>          Issue Type: Bug
>            Reporter: Akanksha kedia
>            Assignee: Akanksha kedia
>            Priority: Major
>
> * Identify the Jackson version packaged by {{{}parquet-hadoop-bundle:1.15.1{}}}.
>  * Check the compatible upstream Parquet/Hadoop version that includes a remediated Jackson dependency.
>  * Upgrade {{parquet-hadoop-bundle}} to the compatible fixed version, or update/exclude and explicitly manage the affected Jackson artifacts if a Parquet upgrade is not feasible.
>  * Run dependency tree and full Hive validation after the change to ensure no Hadoop/Parquet compatibility regressions.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)