You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@hudi.apache.org by "nsivabalan (via GitHub)" <gi...@apache.org> on 2026/06/25 03:40:38 UTC

Re: [I] Fix Critical and High vulnerabilities reported in hudi jar [hudi]

nsivabalan commented on issue #16421:
URL: https://github.com/apache/hudi/issues/16421#issuecomment-4795603279

   This issue can likely be closed. CVE-2018-1282 affects Apache Hive versions prior to 2.3.3, but current master pins `hive.version=2.3.10` in the root `pom.xml`. All `hive-jdbc` dependencies across the project (hudi-cli, hudi-hadoop-mr, hudi-integ-test, packaging bundles) inherit this version, so the vulnerable JDBC driver code is no longer pulled in.
   
   If there are other CVEs from the original linked issue (#10893) still outstanding, please open a fresh issue scoped to those specific CVEs with the affected jars/versions.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org