You are viewing a plain text version of this content. The canonical link for it is here.
Posted to hdfs-issues@hadoop.apache.org by "Souryakanta Dwivedy (Jira)" <ji...@apache.org> on 2020/12/21 10:54:00 UTC
[jira] [Updated] (HDFS-15741) Vulnerability fixes need for Hadoop
dependency library
[ https://issues.apache.org/jira/browse/HDFS-15741?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Souryakanta Dwivedy updated HDFS-15741:
---------------------------------------
Description:
Vulnerability fixes need for Hadoop dependency library
Below are the jars used for hadoop where CVEs are found
Jackson [version 2.10.3 ]
- jackson-core-2.10.3.jar
CVE details :- [ CVE-2020-25649 ]
======================
Jackson-core [version 2.4.0 ]
- htrace-core-3.1.0-incubating.jar
CVE details :- [ CVE-2020-24616 ]
================ =====
Jetty [version 9.4.20.v20190813 ]
- jetty-server-9.4.20.v20190813.jar
CVE details :- [ CVE-2020-27216 ]
================ =====
Jetty-http [version 9.4.20.v20190813 ]
- jetty-http-9.4.20.v20190813.jar
CVE details :- [ CVE-2020-27216 ]
================ =====
was:
Vulnerability fixes need in openssl for Hadoop native library
Below are the files used for hadoop where CVEs are found
openssl [version 1.1.1g ]
- libcrypto.a
- libssl.a
- libcrypto.so.1.1
- libssl.so.1.1
CVE details :-
================
CVE-2020-1971
Summary: Vulnerability fixes need for Hadoop dependency library (was: Vulnerability fixes need in openssl for Hadoop native library)
> Vulnerability fixes need for Hadoop dependency library
> -------------------------------------------------------
>
> Key: HDFS-15741
> URL: https://issues.apache.org/jira/browse/HDFS-15741
> Project: Hadoop HDFS
> Issue Type: Bug
> Components: security
> Affects Versions: 3.1.1
> Reporter: Souryakanta Dwivedy
> Priority: Minor
> Attachments: Openssl_CVEs.png
>
>
> Vulnerability fixes need for Hadoop dependency library
> Below are the jars used for hadoop where CVEs are found
> Jackson [version 2.10.3 ]
> - jackson-core-2.10.3.jar
> CVE details :- [ CVE-2020-25649 ]
> ======================
> Jackson-core [version 2.4.0 ]
> - htrace-core-3.1.0-incubating.jar
> CVE details :- [ CVE-2020-24616 ]
> ================ =====
> Jetty [version 9.4.20.v20190813 ]
> - jetty-server-9.4.20.v20190813.jar
> CVE details :- [ CVE-2020-27216 ]
> ================ =====
> Jetty-http [version 9.4.20.v20190813 ]
> - jetty-http-9.4.20.v20190813.jar
> CVE details :- [ CVE-2020-27216 ]
> ================ =====
>
>
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: hdfs-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: hdfs-issues-help@hadoop.apache.org