You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@hive.apache.org by "Bharathkrishna Guruvayoor Murali (JIRA)" <ji...@apache.org> on 2018/10/02 05:51:00 UTC

[jira] [Commented] (HIVE-20659) Update commons-compress to 1.18 due to security issues

    [ https://issues.apache.org/jira/browse/HIVE-20659?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16635056#comment-16635056 ] 

Bharathkrishna Guruvayoor Murali commented on HIVE-20659:
---------------------------------------------------------

Should we be making changes on all the versions, or just in the current (4.0)?

I can take this up if nobody is working on it.

> Update commons-compress to 1.18 due to security issues
> ------------------------------------------------------
>
>                 Key: HIVE-20659
>                 URL: https://issues.apache.org/jira/browse/HIVE-20659
>             Project: Hive
>          Issue Type: Bug
>          Components: Hive
>    Affects Versions: 1.2.1, 3.0.0, 2.3.2, 3.1.0
>            Reporter: Jörn Franke
>            Priority: Critical
>
> Currently most Hive version depends on commons-compress 1.9 or 1.4. Those versions have several security issues: [https://commons.apache.org/proper/commons-compress/security-reports.html]
> I propose to upgrade all commons-compress dependencies in all Hive (sub-)projects to at least 1.18. This will also make it easier for future extensions to Hive (serde, udfs, etc.) that have dependencies to commons-compress (e.g. [https://github.com/zuinnote/hadoopoffice/wiki)] to integrate into Hive without upgrading the commons-compress library manually in the Hive lib folder.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)