You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@hive.apache.org by "Sumin Byeon (Jira)" <ji...@apache.org> on 2019/10/21 04:45:00 UTC

[jira] [Created] (HIVE-22374) Upgrade commons-compress version to 1.19

Sumin Byeon created HIVE-22374:
----------------------------------

             Summary: Upgrade commons-compress version to 1.19
                 Key: HIVE-22374
                 URL: https://issues.apache.org/jira/browse/HIVE-22374
             Project: Hive
          Issue Type: Bug
            Reporter: Sumin Byeon


As described in [CVE-2019-12402|https://nvd.nist.gov/vuln/detail/CVE-2019-12402], {{commons-compress:1.18}} has an issue where certain inputs may cause an infinite loop which leads to a denial of service attack.

This patch simply upgrades {{common-compress}} versions from 1.18 to 1.19 which is the latest minor version at the date of filing this issue ([Maven repo|https://mvnrepository.com/artifact/org.apache.commons/commons-compress]).



--
This message was sent by Atlassian Jira
(v8.3.4#803005)