[
https://issues.apache.org/jira/browse/HADOOP-18687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17709654#comment-17709654
]
ASF GitHub Bot commented on HADOOP-18687:
-----------------------------------------
pjfanning commented on PR #5524:
URL: https://github.com/apache/hadoop/pull/5524#issuecomment-1500182250
json-smart has a CVE - would it be possible to upgrade
[com.jayway.jsonpath/json-path](https://mvnrepository.com/artifact/com.jayway.jsonpath/json-path)
to the latest version (which also uses the latest version of
[json-smart](https://mvnrepository.com/artifact/net.minidev/json-smart) - that
is CVE free)?
> Remove unnecessary dependency on json-smart
> -------------------------------------------
>
> Key: HADOOP-18687
> URL: https://issues.apache.org/jira/browse/HADOOP-18687
> Project: Hadoop Common
> Issue Type: Improvement
> Components: auth
> Affects Versions: 3.4.0, 3.3.5
> Reporter: Michiel de Jong
> Assignee: Michiel de Jong
> Priority: Major
> Labels: pull-request-available
> Fix For: 3.4.0
>
>
> hadoop-auth has a dependency on net.minidev:json-smart 2.4.7, but this
> dependency is never used.
> This dependency was originally included because the transitive dependency
> that nimbus-jose-jwt had did not work properly (see
> https://issues.apache.org/jira/browse/HADOOP-14903). Since version 9.*
> nimbus-jose-jwt is using its own shaded version of json-smart, so the version
> declared in hadoop-auth is never actually used.
> json-smart 2.4.7 shows up in CVE scans for CVE-2023-1370. It is still used as
> a transitive dependency in hadoop-hdfs
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
