You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@spark.apache.org by "Douglas Gerhardt (Jira)" <ji...@apache.org> on 2021/03/04 10:58:00 UTC
[jira] [Created] (SPARK-34618) CVEs in library dependencies
Douglas Gerhardt created SPARK-34618:
----------------------------------------
Summary: CVEs in library dependencies
Key: SPARK-34618
URL: https://issues.apache.org/jira/browse/SPARK-34618
Project: Spark
Issue Type: Bug
Components: PySpark
Affects Versions: 3.1.1
Reporter: Douglas Gerhardt
There are several CVEs in dependency libraries in the current version of pyspark, including shaded ones under JARs such as
* htrace-core4-4.1.0-incubating.jar:jackson-databind
Are these already being looked at? If not, could they be update to reference newer versions? Thanks.
|CVE ID|Type|Severity|Packages|Package Version|CVSS|Fix Status|
|CVE-2017-18640|java|high|org.yaml_snakeyaml|1.24|7.5|fixed in 1.26|
|CVE-2020-25649|java|high|com.fasterxml.jackson.core_jackson-databind|2.10.0|7.5|fixed in 2.10.5.1, 2.9.10.7, 2.6.7.4|
|CVE-2020-35491|java|high|com.fasterxml.jackson.core_jackson-databind|2.4.0|8.1|fixed in 2.9.10.8|
|CVE-2020-35490|java|high|com.fasterxml.jackson.core_jackson-databind|2.4.0|8.1|fixed in 2.9.10.8|
|CVE-2018-14718|java|critical|com.fasterxml.jackson.core_jackson-databind|2.4.0|9.8|fixed in 2.9.7|
|CVE-2018-7489|java|critical|com.fasterxml.jackson.core_jackson-databind|2.4.0|9.8|fixed in 2.9.5, 2.8.11.1, 2.7.9.3|
|CVE-2020-25649|java|high|com.fasterxml.jackson.core_jackson-databind|2.10.0|7.5|fixed in 2.10.5.1, 2.9.10.7, 2.6.7.4|
|CVE-2020-35491|java|high|com.fasterxml.jackson.core_jackson-databind|2.4.0|8.1|fixed in 2.9.10.8|
|CVE-2020-35490|java|high|com.fasterxml.jackson.core_jackson-databind|2.4.0|8.1|fixed in 2.9.10.8|
|CVE-2018-14718|java|critical|com.fasterxml.jackson.core_jackson-databind|2.4.0|9.8|fixed in 2.9.7|
|CVE-2018-7489|java|critical|com.fasterxml.jackson.core_jackson-databind|2.4.0|9.8|fixed in 2.9.5, 2.8.11.1, 2.7.9.3|
|CVE-2017-18640|java|high|org.yaml_snakeyaml|1.24|7.5|fixed in 1.26|
|CVE-2020-25649|java|high|com.fasterxml.jackson.core_jackson-databind|2.10.0|7.5|fixed in 2.10.5.1, 2.9.10.7, 2.6.7.4|
|CVE-2020-35491|java|high|com.fasterxml.jackson.core_jackson-databind|2.4.0|8.1|fixed in 2.9.10.8|
|CVE-2020-35490|java|high|com.fasterxml.jackson.core_jackson-databind|2.4.0|8.1|fixed in 2.9.10.8|
|CVE-2018-14718|java|critical|com.fasterxml.jackson.core_jackson-databind|2.4.0|9.8|fixed in 2.9.7|
|CVE-2018-7489|java|critical|com.fasterxml.jackson.core_jackson-databind|2.4.0|9.8|fixed in 2.9.5, 2.8.11.1, 2.7.9.3|
|CVE-2017-18640|java|high|org.yaml_snakeyaml|1.24|7.5|fixed in 1.26|
|CVE-2019-17195|java|critical|com.nimbusds_nimbus-jose-jwt|4.41.1|9.8|fixed in 7.9|
Similar issues, for reference:
# CAMEL-14640
# HADOOP-16690
# ZEPPELIN-4657
# HDFS-15333
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org