You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@spark.apache.org by "Ronald Brill (Jira)" <ji...@apache.org> on 2023/11/19 09:27:00 UTC
[jira] [Commented] (SPARK-43864) Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL
[ https://issues.apache.org/jira/browse/SPARK-43864?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17787576#comment-17787576 ]
Ronald Brill commented on SPARK-43864:
--------------------------------------
There is a small migration guide at [https://www.htmlunit.org/migration.html.]
You can contact me at any time and i will try to help with the migration and maybe fixes if some regressions are found.
> Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL
> ----------------------------------------------------------------------------------------------------------------------------------------
>
> Key: SPARK-43864
> URL: https://issues.apache.org/jira/browse/SPARK-43864
> Project: Spark
> Issue Type: Improvement
> Components: Build
> Affects Versions: 3.4.0
> Reporter: gaoyajun02
> Priority: Minor
>
> CVE-2023-26119 Detail: [https://nvd.nist.gov/vuln/detail/CVE-2023-26119]
> It is recommended to replace 'net.sourceforge.htmlunit'' by 'org.htmlunit' in spark
> {code:java}
> <dependency>
> <groupId>org.htmlunit</groupId>
> <artifactId>htmlunit</artifactId>
> <scope>test</scope>
> </dependency>
> <dependency>
> <groupId>org.htmlunit</groupId>
> <artifactId>htmlunit-core-js</artifactId>
> <scope>test</scope>
> </dependency> {code}
> see: [https://www.htmlunit.org/migration.html]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org