You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@hive.apache.org by "David Lavati (JIRA)" <ji...@apache.org> on 2019/07/18 14:31:00 UTC
[jira] [Comment Edited] (HIVE-21173) Upgrade Apache Thrift to
0.9.3-1
[ https://issues.apache.org/jira/browse/HIVE-21173?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16888030#comment-16888030 ]
David Lavati edited comment on HIVE-21173 at 7/18/19 2:30 PM:
--------------------------------------------------------------
There weren't any generated changes, as this release didn't affect that part of the codebase.
was (Author: dlavati):
There weren't any generated changes, as this release only affected the related jar.
> Upgrade Apache Thrift to 0.9.3-1
> --------------------------------
>
> Key: HIVE-21173
> URL: https://issues.apache.org/jira/browse/HIVE-21173
> Project: Hive
> Issue Type: Bug
> Components: Thrift API
> Reporter: James E. King III
> Assignee: David Lavati
> Priority: Major
> Labels: pull-request-available
> Attachments: HIVE-21173.01.patch
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> The project currently depends on libthrift-0.9.3, however thrift released 0.12.0 on 2019-JAN-04. This release includes a security fix for THRIFT-4506 (CVE-2018-1320). Updating thrift to the latest version will remove that vulnerability.
> Also note the Apache Thrift project does not publish "libfb303" any longer. fb303 is contributed code (in '/contrib') and it has not been maintained.
>
> Ps.: 0.9.3.1 also addresses the CVE, see THRIFT-4506
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)