You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@impala.apache.org by jo...@apache.org on 2020/05/04 15:57:34 UTC
[impala] branch master updated: IMPALA-9648: Exclude/ban netty*
from mvn download
This is an automated email from the ASF dual-hosted git repository.
joemcdonnell pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/impala.git
The following commit(s) were added to refs/heads/master by this push:
new 807b8dc IMPALA-9648: Exclude/ban netty* from mvn download
807b8dc is described below
commit 807b8dc81b815a690ecb0fc468e4eb6c92bb1e29
Author: David Knupp <dk...@cloudera.com>
AuthorDate: Mon Apr 27 17:46:00 2020 -0700
IMPALA-9648: Exclude/ban netty* from mvn download
Early verisons of netty-all and netty has known security issues.
Exclude them and ensure they're banned by using maven-enforcer-plugin.
Tested by cherry-picking this patch onto various branches and making
sure that the build is still successful, as well as building with
USE_CDP_HIVE set to both true and false.
Change-Id: Ie7d61af3c10ee439ca9eef3840403229e6235c97
Reviewed-on: http://gerrit.cloudera.org:8080/15829
Reviewed-by: Joe McDonnell <jo...@cloudera.com>
Tested-by: Impala Public Jenkins <im...@cloudera.com>
---
fe/pom.xml | 44 +++++++++++++++++++++++++++++++++++---------
1 file changed, 35 insertions(+), 9 deletions(-)
diff --git a/fe/pom.xml b/fe/pom.xml
index 94c0cf8..db5fd9a 100644
--- a/fe/pom.xml
+++ b/fe/pom.xml
@@ -68,6 +68,11 @@ under the License.
<groupId>org.fusesource.leveldbjni</groupId>
<artifactId>*</artifactId>
</exclusion>
+ <exclusion>
+ <!-- IMPALA-9468: Avoid pulling in netty for security reasons -->
+ <groupId>io.netty</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
</dependency>
<dependency>
@@ -89,9 +94,13 @@ under the License.
<groupId>org.eclipse.jetty</groupId>
<artifactId>*</artifactId>
</exclusion>
+ <exclusion>
+ <!-- IMPALA-9468: Avoid pulling in netty for security reasons -->
+ <groupId>io.netty</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
</dependency>
-
<dependency>
<groupId>org.apache.hadoop</groupId>
<artifactId>hadoop-auth</artifactId>
@@ -793,6 +802,8 @@ under the License.
<!-- IMPALA-9649 (Avoid pulling in shiro* due to CVE's) -->
<exclude>org.apache.shiro:shiro-core:*</exclude>
<exclude>org.apache.shiro:shiro-crypto-cipher:*</exclude>
+ <!-- IMPALA-9648: Ensure that netty-all is not present. -->
+ <exclude>io.netty:*</exclude>
<!-- Assert that we only use artifacts from only the specified
version of these components. -->
<exclude>org.apache.hadoop:*</exclude>
@@ -972,14 +983,14 @@ under the License.
<groupId>org.apache.calcite.avatica</groupId>
<artifactId>avatica</artifactId>
</exclusion>
- <exclusion>
- <groupId>org.eclipse.jetty</groupId>
- <artifactId>*</artifactId>
- </exclusion>
- <exclusion>
- <groupId>ant</groupId>
- <artifactId>*</artifactId>
- </exclusion>
+ <exclusion>
+ <groupId>org.eclipse.jetty</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>ant</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
</dependency>
@@ -1102,6 +1113,11 @@ under the License.
<groupId>org.eclipse.jetty</groupId>
<artifactId>*</artifactId>
</exclusion>
+ <exclusion>
+ <!-- IMPALA-9468: Avoid pulling in netty for security reasons -->
+ <groupId>io.netty</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
</dependency>
@@ -1128,6 +1144,11 @@ under the License.
<groupId>org.eclipse.jetty</groupId>
<artifactId>*</artifactId>
</exclusion>
+ <exclusion>
+ <!-- IMPALA-9468: Avoid pulling in netty for security reasons -->
+ <groupId>io.netty</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
</dependency>
@@ -1232,6 +1253,11 @@ under the License.
<groupId>org.fusesource.leveldbjni</groupId>
<artifactId>*</artifactId>
</exclusion>
+ <exclusion>
+ <!-- IMPALA-9468: Avoid pulling in netty for security reasons -->
+ <groupId>io.netty</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
</exclusions>
</dependency>
<dependency>