You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-issues@hadoop.apache.org by "Wei-Chiu Chuang (Jira)" <ji...@apache.org> on 2019/11/05 18:32:00 UTC
[jira] [Commented] (HADOOP-16676) Security Vulnerability for
dependency jetty-xml (Backport HADOOP-16152 to branch-3.2)
[ https://issues.apache.org/jira/browse/HADOOP-16676?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16967753#comment-16967753 ]
Wei-Chiu Chuang commented on HADOOP-16676:
------------------------------------------
Hey [~smeng] I think you attached the wrong patch. Could you check again? Thanks.
> Security Vulnerability for dependency jetty-xml (Backport HADOOP-16152 to branch-3.2)
> -------------------------------------------------------------------------------------
>
> Key: HADOOP-16676
> URL: https://issues.apache.org/jira/browse/HADOOP-16676
> Project: Hadoop Common
> Issue Type: Bug
> Components: common
> Affects Versions: 3.2.1
> Reporter: DW
> Assignee: Siyao Meng
> Priority: Major
> Attachments: HADOOP-16676.branch-3.2.001.patch
>
>
> Hello,
>
> org.apache.hadoop:hadoop-common define the dependency to jetty-webapp and jetty-xml in version v9.3.24 with known CVE-2017-9735. Please can you upgrade to version 9.4.7 or higher?
> +--- org.apache.hadoop:hadoop-client:3.2.1
> | +--- org.apache.hadoop:hadoop-common:3.2.1
> | +--- org.eclipse.jetty:jetty-webapp:9.3.24.v20180605
> | | | +--- org.eclipse.jetty:jetty-xml:9.3.24.v20180605
> | | | \--- org.eclipse.jetty:jetty-servlet:9.3.24.v20180605 (*)
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org