[
https://issues.apache.org/jira/browse/HADOOP-16676?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HADOOP-16676:
--------------------------------
Attachment: HADOOP-16676.branch-3.2.001.patch
Status: Patch Available (was: In Progress)
Thanks for pointing that out. Turns out I used "git diff" by mistake (should
use "git show") on my local commit. As a result I uploaded the revert of
YARN-9949 since I was testing the compilation locally. Now that YARN-9949 is
already reverted. It shouldn't be a problem.
Uploading the right patch.
> Security Vulnerability for dependency jetty-xml (Backport HADOOP-16152 to
> branch-3.2)
> -------------------------------------------------------------------------------------
>
> Key: HADOOP-16676
> URL: https://issues.apache.org/jira/browse/HADOOP-16676
> Project: Hadoop Common
> Issue Type: Bug
> Components: common
> Affects Versions: 3.2.1
> Reporter: DW
> Assignee: Siyao Meng
> Priority: Major
> Attachments: HADOOP-16676.branch-3.2.001.patch,
> HADOOP-16676.branch-3.2.001.patch
>
>
> Hello,
>
> org.apache.hadoop:hadoop-common define the dependency to jetty-webapp and
> jetty-xml in version v9.3.24 with known CVE-2017-9735. Please can you upgrade
> to version 9.4.7 or higher?
> +--- org.apache.hadoop:hadoop-client:3.2.1
> | +--- org.apache.hadoop:hadoop-common:3.2.1
> | +--- org.eclipse.jetty:jetty-webapp:9.3.24.v20180605
> | | | +--- org.eclipse.jetty:jetty-xml:9.3.24.v20180605
> | | | \--- org.eclipse.jetty:jetty-servlet:9.3.24.v20180605 (*)
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
