You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-issues@hadoop.apache.org by "Steve Loughran (Jira)" <ji...@apache.org> on 2022/10/10 15:13:00 UTC
[jira] [Commented] (HADOOP-18197) Update protobuf 3.7.1 to a version without CVE-2021-22569
[ https://issues.apache.org/jira/browse/HADOOP-18197?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17615157#comment-17615157 ]
Steve Loughran commented on HADOOP-18197:
-----------------------------------------
I'm doing a version of thirdparty jar where the protobuf lib is called protobuf_3_21; here is a release with storediag hdfs://localhost/
{code}
class: com.google.protobuf.ExtensionRegistry
resource: com/google/protobuf/ExtensionRegistry.class
jar:file:/Users/stevel/Projects/Releases/hadoop-3.4.0-SNAPSHOT/share/hadoop/common/lib/protobuf-java-2.5.0.jar!/com/google/protobuf/ExtensionRegistry.class
file:/Users/stevel/Projects/Releases/hadoop-3.4.0-SNAPSHOT/share/hadoop/common/lib/protobuf-java-2.5.0.jar
class: org.apache.hadoop.shaded.com.google.protobuf.ExtensionRegistry
resource: org/apache/hadoop/shaded/com/google/protobuf/ExtensionRegistry.class
Not found on classpath: org.apache.hadoop.shaded.com.google.protobuf.ExtensionRegistry
class: org.apache.hadoop.thirdparty.protobuf.ExtensionRegistry
resource: org/apache/hadoop/thirdparty/protobuf/ExtensionRegistry.class
jar:file:/Users/stevel/Projects/Releases/hadoop-3.4.0-SNAPSHOT/share/hadoop/common/lib/hadoop-shaded-protobuf_3_21-1.2.0-SNAPSHOT.jar!/+.class
file:/Users/stevel/Projects/Releases/hadoop-3.4.0-SNAPSHOT/share/hadoop/common/lib/hadoop-shaded-protobuf_3_21-1.2.0-SNAPSHOT.jar
{code}
this shows things have moved to org/apache/hadoop/thirdparty/protobuf in the jar hadoop-shaded-protobuf_3_21-1.2.0-SNAPSHOT.jar
> Update protobuf 3.7.1 to a version without CVE-2021-22569
> ---------------------------------------------------------
>
> Key: HADOOP-18197
> URL: https://issues.apache.org/jira/browse/HADOOP-18197
> Project: Hadoop Common
> Issue Type: Improvement
> Reporter: Ivan Viaznikov
> Assignee: Steve Loughran
> Priority: Major
> Labels: pull-request-available, security
> Time Spent: 50m
> Remaining Estimate: 0h
>
> The artifact `org.apache.hadoop:hadoop-common` brings in a dependency `com.google.protobuf:protobuf-java:2.5.0`, which is an outdated version released in 2013 and it contains a vulnerability [CVE-2021-22569|https://nvd.nist.gov/vuln/detail/CVE-2021-22569].
> Therefore, requesting you to clarify if this library version is going to be updated in the following releases
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org