You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hudi.apache.org by "mehradpk (via GitHub)" <gi...@apache.org> on 2024/09/26 05:27:32 UTC
[PR] Fix for CVE-2023-39410 and CVE-2020-13956 [hudi]
mehradpk opened a new pull request, #12010:
URL: https://github.com/apache/hudi/pull/12010
Upgrade httpclient version to 4.5.13
Upgrade avro version to 1.11.3
**Reference PR** - https://github.com/apache/hudi/pull/11964
### Change Logs
This issue will address the below CVE from hudi-presto-bundle:0.14.0 jar
https://nvd.nist.gov/vuln/detail/CVE-2023-39410
https://nvd.nist.gov/vuln/detail/CVE-2020-13956
### Impact
No user facing impacts
### Risk level (write none, low medium or high below)
Included the new changes in presto and we haven't seen any regression issues
### Documentation Update
None
### Contributor's checklist
- [x] Read through [contributor's guide](https://hudi.apache.org/contribute/how-to-contribute)
- [x] Change Logs and Impact were stated clearly
- [x] Adequate tests were added if applicable
- [ ] CI passed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix for CVE-2023-39410 and CVE-2020-13956 [hudi]
Posted by "hudi-bot (via GitHub)" <gi...@apache.org>.
hudi-bot commented on PR #12010:
URL: https://github.com/apache/hudi/pull/12010#issuecomment-2426020583
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "33da3523bba3d0ccb40ef343bd664501f351f126",
"status" : "SUCCESS",
"url" : "https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=796",
"triggerID" : "33da3523bba3d0ccb40ef343bd664501f351f126",
"triggerType" : "PUSH"
}, {
"hash" : "1fd33ed9f98847dc05a2e4eba1b40b0e939b389b",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "1fd33ed9f98847dc05a2e4eba1b40b0e939b389b",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 33da3523bba3d0ccb40ef343bd664501f351f126 Azure: [SUCCESS](https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=796)
* 1fd33ed9f98847dc05a2e4eba1b40b0e939b389b UNKNOWN
<details>
<summary>Bot commands</summary>
@hudi-bot supports the following commands:
- `@hudi-bot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix for CVE-2023-39410 and CVE-2020-13956 [hudi]
Posted by "danny0405 (via GitHub)" <gi...@apache.org>.
danny0405 commented on code in PR #12010:
URL: https://github.com/apache/hudi/pull/12010#discussion_r1776704849
##########
pom.xml:
##########
@@ -175,7 +175,7 @@
(hudi.spark.common.modules.*) -->
<hudi.spark.common.modules.1>hudi-spark3-common</hudi.spark.common.modules.1>
<hudi.spark.common.modules.2>hudi-spark3.2plus-common</hudi.spark.common.modules.2>
- <avro.version>1.8.2</avro.version>
+ <avro.version>1.11.3</avro.version>
Review Comment:
Not sure whether spark-avro work with this, since 1.9, avro introduces many breaking change in their API.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix for CVE-2023-39410 and CVE-2020-13956 [hudi]
Posted by "hudi-bot (via GitHub)" <gi...@apache.org>.
hudi-bot commented on PR #12010:
URL: https://github.com/apache/hudi/pull/12010#issuecomment-2426168183
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "33da3523bba3d0ccb40ef343bd664501f351f126",
"status" : "DELETED",
"url" : "https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=796",
"triggerID" : "33da3523bba3d0ccb40ef343bd664501f351f126",
"triggerType" : "PUSH"
}, {
"hash" : "1fd33ed9f98847dc05a2e4eba1b40b0e939b389b",
"status" : "SUCCESS",
"url" : "https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=1303",
"triggerID" : "1fd33ed9f98847dc05a2e4eba1b40b0e939b389b",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 1fd33ed9f98847dc05a2e4eba1b40b0e939b389b Azure: [SUCCESS](https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=1303)
<details>
<summary>Bot commands</summary>
@hudi-bot supports the following commands:
- `@hudi-bot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix for CVE-2023-39410 and CVE-2020-13956 [hudi]
Posted by "hudi-bot (via GitHub)" <gi...@apache.org>.
hudi-bot commented on PR #12010:
URL: https://github.com/apache/hudi/pull/12010#issuecomment-2375948486
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "33da3523bba3d0ccb40ef343bd664501f351f126",
"status" : "PENDING",
"url" : "https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=796",
"triggerID" : "33da3523bba3d0ccb40ef343bd664501f351f126",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 33da3523bba3d0ccb40ef343bd664501f351f126 Azure: [PENDING](https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=796)
<details>
<summary>Bot commands</summary>
@hudi-bot supports the following commands:
- `@hudi-bot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix for CVE-2023-39410 and CVE-2020-13956 [hudi]
Posted by "hudi-bot (via GitHub)" <gi...@apache.org>.
hudi-bot commented on PR #12010:
URL: https://github.com/apache/hudi/pull/12010#issuecomment-2375935242
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "33da3523bba3d0ccb40ef343bd664501f351f126",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "33da3523bba3d0ccb40ef343bd664501f351f126",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 33da3523bba3d0ccb40ef343bd664501f351f126 UNKNOWN
<details>
<summary>Bot commands</summary>
@hudi-bot supports the following commands:
- `@hudi-bot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix for CVE-2023-39410 and CVE-2020-13956 [hudi]
Posted by "hudi-bot (via GitHub)" <gi...@apache.org>.
hudi-bot commented on PR #12010:
URL: https://github.com/apache/hudi/pull/12010#issuecomment-2426024094
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "33da3523bba3d0ccb40ef343bd664501f351f126",
"status" : "SUCCESS",
"url" : "https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=796",
"triggerID" : "33da3523bba3d0ccb40ef343bd664501f351f126",
"triggerType" : "PUSH"
}, {
"hash" : "1fd33ed9f98847dc05a2e4eba1b40b0e939b389b",
"status" : "PENDING",
"url" : "https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=1303",
"triggerID" : "1fd33ed9f98847dc05a2e4eba1b40b0e939b389b",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 33da3523bba3d0ccb40ef343bd664501f351f126 Azure: [SUCCESS](https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=796)
* 1fd33ed9f98847dc05a2e4eba1b40b0e939b389b Azure: [PENDING](https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=1303)
<details>
<summary>Bot commands</summary>
@hudi-bot supports the following commands:
- `@hudi-bot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix for CVE-2023-39410 and CVE-2020-13956 [hudi]
Posted by "hudi-bot (via GitHub)" <gi...@apache.org>.
hudi-bot commented on PR #12010:
URL: https://github.com/apache/hudi/pull/12010#issuecomment-2376062800
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "33da3523bba3d0ccb40ef343bd664501f351f126",
"status" : "SUCCESS",
"url" : "https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=796",
"triggerID" : "33da3523bba3d0ccb40ef343bd664501f351f126",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 33da3523bba3d0ccb40ef343bd664501f351f126 Azure: [SUCCESS](https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=796)
<details>
<summary>Bot commands</summary>
@hudi-bot supports the following commands:
- `@hudi-bot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [HUDI-8402] Fix for CVE-2023-39410 and CVE-2020-13956 [hudi]
Posted by "danny0405 (via GitHub)" <gi...@apache.org>.
danny0405 merged PR #12010:
URL: https://github.com/apache/hudi/pull/12010
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org