hive-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From László Bodor (Jira) <j...@apache.org>
Subject [jira] [Commented] (HIVE-22374) Upgrade commons-compress version to 1.19
Date Fri, 01 Nov 2019 14:44:00 GMT

    [ https://issues.apache.org/jira/browse/HIVE-22374?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16964883#comment-16964883
] 

László Bodor commented on HIVE-22374:
-------------------------------------

tests already passed for 2.patch, so +1

> Upgrade commons-compress version to 1.19
> ----------------------------------------
>
>                 Key: HIVE-22374
>                 URL: https://issues.apache.org/jira/browse/HIVE-22374
>             Project: Hive
>          Issue Type: Bug
>          Components: Hive
>            Reporter: Sumin Byeon
>            Assignee: Sumin Byeon
>            Priority: Critical
>         Attachments: HIVE-22374.1.patch, HIVE-22374.2.patch
>
>
> As described in [CVE-2019-12402|https://nvd.nist.gov/vuln/detail/CVE-2019-12402], {{commons-compress:1.18}}
has an issue where certain inputs may cause an infinite loop which leads to a denial of service
attack.
> This patch simply upgrades {{common-compress}} versions from 1.18 to 1.19 which is the
latest minor version at the date of filing this issue ([Maven repo|https://mvnrepository.com/artifact/org.apache.commons/commons-compress]).



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

Mime
View raw message