You are viewing a plain text version of this content. The canonical link for it is here.
Posted to gitbox@hive.apache.org by "slfan1989 (via GitHub)" <gi...@apache.org> on 2024/05/05 05:22:51 UTC
[PR] HIVE-28245. Upgrade Spring to 5.3.27 due to CVE. [hive]
slfan1989 opened a new pull request, #5237:
URL: https://github.com/apache/hive/pull/5237
<!--
Thanks for sending a pull request! Here are some tips for you:
1. If this is your first time, please read our contributor guidelines: https://cwiki.apache.org/confluence/display/Hive/HowToContribute
2. Ensure that you have created an issue on the Hive project JIRA: https://issues.apache.org/jira/projects/HIVE/summary
3. Ensure you have added or run the appropriate tests for your PR:
4. If the PR is unfinished, add '[WIP]' in your PR title, e.g., '[WIP]HIVE-XXXXX: Your PR title ...'.
5. Be sure to keep the PR description updated to reflect all changes.
6. Please write your PR title to summarize what this PR proposes.
7. If possible, provide a concise example to reproduce the issue for a faster review.
-->
### What changes were proposed in this pull request?
JIRA: HIVE-28245. Upgrade Spring to 5.3.27 due to CVE.
I found that there are 2 CVE issues in the current Spring version, CVE-2023-20863 and CVE-2023-20861; we can upgrade the Spring version to 5.3.27 to solve this issue.
[CVE-2023-20861](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20861)
[CVE-2023-20863](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-20863)
### Why are the changes needed?
We need to upgrade to resolve CVE Issue.
### Does this PR introduce _any_ user-facing change?
No.
### Is the change a dependency upgrade?
No.
### How was this patch tested?
Compile locally
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28245. Upgrade Spring to 5.3.27 due to CVE. [hive]
Posted by "Aggarwal-Raghav (via GitHub)" <gi...@apache.org>.
Aggarwal-Raghav commented on PR #5237:
URL: https://github.com/apache/hive/pull/5237#issuecomment-2096126420
Thanks for the PR @slfan1989. As this is a dependency upgrade, can you change the description and based on HIVE-27419, can you attach the dependency tree in the PR?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28245. Upgrade Spring to 5.3.27 due to CVE. [hive]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #5237: HIVE-28245. Upgrade Spring to 5.3.27 due to CVE.
URL: https://github.com/apache/hive/pull/5237
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28245. Upgrade Spring to 5.3.27 due to CVE. [hive]
Posted by "zhangbutao (via GitHub)" <gi...@apache.org>.
zhangbutao commented on PR #5237:
URL: https://github.com/apache/hive/pull/5237#issuecomment-2408611192
Superseded by https://github.com/apache/hive/pull/5435
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28245. Upgrade Spring to 5.3.27 due to CVE. [hive]
Posted by "Aggarwal-Raghav (via GitHub)" <gi...@apache.org>.
Aggarwal-Raghav commented on PR #5237:
URL: https://github.com/apache/hive/pull/5237#issuecomment-2096191035
```
org.apache.atlas:atlas-intg:jar:2.3.0:compile
[INFO] | | | | +- commons-validator:commons-validator:jar:1.6:compile
[INFO] | | | | | \- commons-digester:commons-digester:jar:1.8.1:compile
[INFO] | | | | +- com.fasterxml.jackson.jaxrs:jackson-jaxrs-base:jar:2.16.1:compile
[INFO] | | | | +- javax.inject:javax.inject:jar:1:compile
[INFO] | | | | \- org.springframework:spring-context:jar:5.3.21:compile
[INFO] | | | | +- org.springframework:spring-aop:jar:5.3.21:compile
[INFO] | | | | +- org.springframework:spring-beans:jar:5.3.21:compile
[INFO] | | | | \- org.springframework:spring-expression:jar:5.3.21:compile
```
atlas is still bringing spring 5.3.21 and due to it, lib dir contains both the version of spring.
```
spring-aop-5.3.21.jar
spring-beans-5.3.21.jar
spring-context-5.3.21.jar
spring-core-5.3.27.jar
spring-expression-5.3.21.jar
spring-jcl-5.3.27.jar
spring-jdbc-5.3.27.jar
spring-tx-5.3.27.jar
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28245. Upgrade Spring to 5.3.27 due to CVE. [hive]
Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #5237:
URL: https://github.com/apache/hive/pull/5237#issuecomment-2094652541
## [](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5237) **Quality Gate passed**
Issues
 [0 New issues](https://sonarcloud.io/project/issues?id=apache_hive&pullRequest=5237&resolved=false&inNewCodePeriod=true)
 [0 Accepted issues](https://sonarcloud.io/component_measures?id=apache_hive&pullRequest=5237&metric=new_accepted_issues&view=list)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_hive&pullRequest=5237&resolved=false&inNewCodePeriod=true)
 No data about Coverage
 No data about Duplication
[See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache_hive&pullRequest=5237)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28245. Upgrade Spring to 5.3.27 due to CVE. [hive]
Posted by "Aggarwal-Raghav (via GitHub)" <gi...@apache.org>.
Aggarwal-Raghav commented on PR #5237:
URL: https://github.com/apache/hive/pull/5237#issuecomment-2096127426
Otherwise, LGTM.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28245. Upgrade Spring to 5.3.27 due to CVE. [hive]
Posted by "slfan1989 (via GitHub)" <gi...@apache.org>.
slfan1989 commented on PR #5237:
URL: https://github.com/apache/hive/pull/5237#issuecomment-2097151012
> Thanks for the PR @slfan1989. As this is a dependency upgrade, can you change the description and based on [HIVE-27419](https://issues.apache.org/jira/browse/HIVE-27419), can you attach the dependency tree in the PR?
Thank you for suggestions! I will continue to improve this pr.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org
Re: [PR] HIVE-28245. Upgrade Spring to 5.3.27 due to CVE. [hive]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #5237:
URL: https://github.com/apache/hive/pull/5237#issuecomment-2212065790
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.
Feel free to reach out on the dev@hive.apache.org list if the patch is in need of reviews.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: gitbox-unsubscribe@hive.apache.org
For additional commands, e-mail: gitbox-help@hive.apache.org