HDDS-10589. set the net.minidev:json-smart dependency version up to 2.5.0 #6441
Conversation
adoroszlai
left a comment
adoroszlai
left a comment
There was a problem hiding this comment.
As the changes in jar-report.txt indicate, Ozone currently does not depend on json-smart. We should not introduce this dependency.
The dependency on Hadoop 2.x is provided, meaning that users need to supply Hadoop and its dependencies. Therefore, anyone using ozone-filesystem-hadoop2-*.jar can simply upgrade json-smart on their end.
dineshchitlangia
left a comment
dineshchitlangia
left a comment
There was a problem hiding this comment.
Agree with @adoroszlai
@adoroszlai do you suggest not touch the json-smart dependency in ozone-filesystem-hadoop2 module, but in the place where the module is used? (e.g. in hadoop-ozone/dist/pom.xml -> profile=build-with-ozonefs) |
I suggest closing this PR, |
Done |
|
@adoroszlai @dineshchitlangia thanks for the review |
|
Thanks @vtutrinov for working on these version bumps for security. |
3 participants
What changes were proposed in this pull request?
ozone-filesystem-hadoop2 transitively depends on net.minidev:json-smart:2.3 that contains a CVE-2021-31684:
https://nvd.nist.gov/vuln/detail/CVE-2021-31684
netplex/json-smart-v2#67
The version of the library needs to be upgraded to 2.5.0
What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-10589
How was this patch tested?
Existing hadoop related robot tests