You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@hive.apache.org by "Sumin Byeon (Jira)" <ji...@apache.org> on 2019/10/21 04:49:00 UTC
[jira] [Commented] (HIVE-22374) Upgrade commons-compress version to
1.19
[ https://issues.apache.org/jira/browse/HIVE-22374?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16955748#comment-16955748 ]
Sumin Byeon commented on HIVE-22374:
------------------------------------
This is my first time submitting a patch to an Apache project, and I apologize in advance for not strictly following all rules that I'm not aware of yet.
I would like to figure out 'Affects Version/s' and 'Fix Version/s' (and other required labels), and it would be great if someone could point me to a right direction. A wiki page, a guideline, or anything like that would be a great help. Thanks.
> Upgrade commons-compress version to 1.19
> ----------------------------------------
>
> Key: HIVE-22374
> URL: https://issues.apache.org/jira/browse/HIVE-22374
> Project: Hive
> Issue Type: Bug
> Components: Hive
> Reporter: Sumin Byeon
> Priority: Critical
> Attachments: HIVE-22374.patch
>
>
> As described in [CVE-2019-12402|https://nvd.nist.gov/vuln/detail/CVE-2019-12402], {{commons-compress:1.18}} has an issue where certain inputs may cause an infinite loop which leads to a denial of service attack.
> This patch simply upgrades {{common-compress}} versions from 1.18 to 1.19 which is the latest minor version at the date of filing this issue ([Maven repo|https://mvnrepository.com/artifact/org.apache.commons/commons-compress]).
--
This message was sent by Atlassian Jira
(v8.3.4#803005)