You are viewing a plain text version of this content. The canonical link for it is here.

Posted to yarn-dev@hadoop.apache.org by "Benjamin Teke (Jira)" <ji...@apache.org> on 2023/11/06 15:21:00 UTC

[jira] [Created] (YARN-11611) Remove json-io to 4.14.1 due to CVE-2023-34610

Benjamin Teke created YARN-11611:
------------------------------------

             Summary: Remove json-io to 4.14.1 due to CVE-2023-34610
                 Key: YARN-11611
                 URL: https://issues.apache.org/jira/browse/YARN-11611
             Project: Hadoop YARN
          Issue Type: Improvement
          Components: yarn
            Reporter: Benjamin Teke
            Assignee: Benjamin Teke


An issue was discovered in json-io 4.14.0 that allows attackers to cause a denial of service via crafted object that uses cyclic dependencies. de.ruedigermoeller:fst only imports java-util (and through that json-io) as a test dependency, so I think we can safely add an exclusion for it.





--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-dev-unsubscribe@hadoop.apache.org
For additional commands, e-mail: yarn-dev-help@hadoop.apache.org