You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@spark.apache.org by "Abhay Dandekar (Jira)" <ji...@apache.org> on 2023/04/19 04:45:00 UTC

[jira] [Commented] (SPARK-35877) Spark Protobuf jar has CVE issue CVE-2015-5237

    [ https://issues.apache.org/jira/browse/SPARK-35877?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17713891#comment-17713891 ] 

Abhay Dandekar commented on SPARK-35877:
----------------------------------------

Dear team, any target version for this protobuf upgrade? I checked in the latest SPARK (spark-3.3.2-bin-hadoop3), and it is still using protobuf-java-2.5.0.jar.

Thank you.

> Spark Protobuf jar has CVE issue CVE-2015-5237
> ----------------------------------------------
>
>                 Key: SPARK-35877
>                 URL: https://issues.apache.org/jira/browse/SPARK-35877
>             Project: Spark
>          Issue Type: Bug
>          Components: Security, Spark Core
>    Affects Versions: 2.4.5, 3.1.1
>            Reporter: jobit mathew
>            Priority: Minor
>
> Spark Protobuf jar has CVE issue CVE-2015-5237



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org