You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hudi.apache.org by "senthh (via GitHub)" <gi...@apache.org> on 2025/01/02 05:47:28 UTC
[PR] HUDI-8805 - Upgrade commons-io version to 2.14.0 to fix CVE-2024-47554 [hudi]
senthh opened a new pull request, #12564:
URL: https://github.com/apache/hudi/pull/12564
### Change Logs
Upgrade commons-io to fix CVE-2024-47554
### Impact
CVE-2024-47554:
Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input.
### Risk level (write none, low medium or high below)
HIGH
### Documentation Update
Upgrade commons-io to 2.14.0 version
### Contributor's checklist
- [ ] Read through [contributor's guide](https://hudi.apache.org/contribute/how-to-contribute)
- [ ] Change Logs and Impact were stated clearly
- [ ] Adequate tests were added if applicable
- [ ] CI passed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [HUDI-8805] Upgrade commons-io version to 2.14.0 to fix CVE-2024-47554 [hudi]
Posted by "hudi-bot (via GitHub)" <gi...@apache.org>.
hudi-bot commented on PR #12564:
URL: https://github.com/apache/hudi/pull/12564#issuecomment-2567477247
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "9d536abb0c26e50722d192fea916249a4a36b725",
"status" : "DELETED",
"url" : "https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=2617",
"triggerID" : "9d536abb0c26e50722d192fea916249a4a36b725",
"triggerType" : "PUSH"
}, {
"hash" : "9d536abb0c26e50722d192fea916249a4a36b725",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "2567474221",
"triggerType" : "MANUAL"
}, {
"hash" : "9d536abb0c26e50722d192fea916249a4a36b725",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "2567476543",
"triggerType" : "MANUAL"
}, {
"hash" : "0000",
"status" : "CANCELED",
"url" : "TBD",
"triggerID" : "2567474221",
"triggerType" : "MANUAL"
} ]
}-->
## CI report:
* 0000 Unknown: [CANCELED](TBD)
<details>
<summary>Bot commands</summary>
@hudi-bot supports the following commands:
- `@hudi-bot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [HUDI-8805] Upgrade commons-io version to 2.14.0 to fix CVE-2024-47554 [hudi]
Posted by "senthh (via GitHub)" <gi...@apache.org>.
senthh commented on PR #12564:
URL: https://github.com/apache/hudi/pull/12564#issuecomment-2567476543
@hudi-bot run tests
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [HUDI-8805] Upgrade commons-io version to 2.14.0 to fix CVE-2024-47554 [hudi]
Posted by "yihua (via GitHub)" <gi...@apache.org>.
yihua closed pull request #12564: [HUDI-8805] Upgrade commons-io version to 2.14.0 to fix CVE-2024-47554
URL: https://github.com/apache/hudi/pull/12564
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [HUDI-8805] Upgrade commons-io version to 2.14.0 to fix CVE-2024-47554 [hudi]
Posted by "senthh (via GitHub)" <gi...@apache.org>.
senthh commented on PR #12564:
URL: https://github.com/apache/hudi/pull/12564#issuecomment-2613947700
@yihua Thanks for reviewing this change. I am facing issue while rebasing so I am creating new PR https://github.com/apache/hudi/pull/12709.
Kindly review this changes in new PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [HUDI-8805] Upgrade commons-io version to 2.14.0 to fix CVE-2024-47554 [hudi]
Posted by "yihua (via GitHub)" <gi...@apache.org>.
yihua commented on PR #12564:
URL: https://github.com/apache/hudi/pull/12564#issuecomment-2614100612
@senthh Thanks. Will do. Closing this one.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [HUDI-8805] Upgrade commons-io version to 2.14.0 to fix CVE-2024-47554 [hudi]
Posted by "hudi-bot (via GitHub)" <gi...@apache.org>.
hudi-bot commented on PR #12564:
URL: https://github.com/apache/hudi/pull/12564#issuecomment-2567350485
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "9d536abb0c26e50722d192fea916249a4a36b725",
"status" : "SUCCESS",
"url" : "https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=2617",
"triggerID" : "9d536abb0c26e50722d192fea916249a4a36b725",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 9d536abb0c26e50722d192fea916249a4a36b725 Azure: [SUCCESS](https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=2617)
<details>
<summary>Bot commands</summary>
@hudi-bot supports the following commands:
- `@hudi-bot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [HUDI-8805] Upgrade commons-io version to 2.14.0 to fix CVE-2024-47554 [hudi]
Posted by "hudi-bot (via GitHub)" <gi...@apache.org>.
hudi-bot commented on PR #12564:
URL: https://github.com/apache/hudi/pull/12564#issuecomment-2567309787
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "9d536abb0c26e50722d192fea916249a4a36b725",
"status" : "PENDING",
"url" : "https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=2617",
"triggerID" : "9d536abb0c26e50722d192fea916249a4a36b725",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 9d536abb0c26e50722d192fea916249a4a36b725 Azure: [PENDING](https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=2617)
<details>
<summary>Bot commands</summary>
@hudi-bot supports the following commands:
- `@hudi-bot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [HUDI-8805] Upgrade commons-io version to 2.14.0 to fix CVE-2024-47554 [hudi]
Posted by "hudi-bot (via GitHub)" <gi...@apache.org>.
hudi-bot commented on PR #12564:
URL: https://github.com/apache/hudi/pull/12564#issuecomment-2567309086
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "9d536abb0c26e50722d192fea916249a4a36b725",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "9d536abb0c26e50722d192fea916249a4a36b725",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 9d536abb0c26e50722d192fea916249a4a36b725 UNKNOWN
<details>
<summary>Bot commands</summary>
@hudi-bot supports the following commands:
- `@hudi-bot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [HUDI-8805] Upgrade commons-io version to 2.14.0 to fix CVE-2024-47554 [hudi]
Posted by "senthh (via GitHub)" <gi...@apache.org>.
senthh commented on PR #12564:
URL: https://github.com/apache/hudi/pull/12564#issuecomment-2567477978
@hudi-bot run azure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [HUDI-8805] Upgrade commons-io version to 2.14.0 to fix CVE-2024-47554 [hudi]
Posted by "senthh (via GitHub)" <gi...@apache.org>.
senthh commented on PR #12564:
URL: https://github.com/apache/hudi/pull/12564#issuecomment-2567474221
/build
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [HUDI-8805] Upgrade commons-io version to 2.14.0 to fix CVE-2024-47554 [hudi]
Posted by "hudi-bot (via GitHub)" <gi...@apache.org>.
hudi-bot commented on PR #12564:
URL: https://github.com/apache/hudi/pull/12564#issuecomment-2567479168
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "9d536abb0c26e50722d192fea916249a4a36b725",
"status" : "DELETED",
"url" : "https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=2617",
"triggerID" : "9d536abb0c26e50722d192fea916249a4a36b725",
"triggerType" : "PUSH"
}, {
"hash" : "9d536abb0c26e50722d192fea916249a4a36b725",
"status" : "SUCCESS",
"url" : "https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=2617",
"triggerID" : "2567474221",
"triggerType" : "MANUAL"
}, {
"hash" : "9d536abb0c26e50722d192fea916249a4a36b725",
"status" : "SUCCESS",
"url" : "https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=2617",
"triggerID" : "2567476543",
"triggerType" : "MANUAL"
}, {
"hash" : "0000",
"status" : "DELETED",
"url" : "TBD",
"triggerID" : "2567474221",
"triggerType" : "MANUAL"
} ]
}-->
## CI report:
* 9d536abb0c26e50722d192fea916249a4a36b725 Azure: [SUCCESS](https://dev.azure.com/apachehudi/a1a51da7-8592-47d4-88dc-fd67bed336bb/_build/results?buildId=2617)
<details>
<summary>Bot commands</summary>
@hudi-bot supports the following commands:
- `@hudi-bot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org