[
https://issues.apache.org/jira/browse/HADOOP-18687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17714254#comment-17714254
]
ASF GitHub Bot commented on HADOOP-18687:
-----------------------------------------
degant commented on PR #5549:
URL: https://github.com/apache/hadoop/pull/5549#issuecomment-1515174820
Do you also plan to upgrade nimbus-jose-jwt to a newer version since the
current version shades json-smart 1.3.2 which gets flagged by scanners for both
CVE-2021-31684 and CVE-2023-1370?
nimbus-jose-jwt also dropped the json-smart dependency completely with
nimbus-jose-jwt 9.24 and replaces it with **Gson 2.9.1 (shaded)** as seen in
the commit history here:
https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/tag/9.24
So upgrading nimbus-jose-jwt from 9.8.1 to >9.24.4 could help completely get
rid of json-smart from scanners and address
[HADOOP-18687](https://issues.apache.org/jira/browse/HADOOP-18687?jql=text%20~%20%22CVE-2023-1370%22).
Related discussion here: #3299
> Remove unnecessary dependency on json-smart
> -------------------------------------------
>
> Key: HADOOP-18687
> URL: https://issues.apache.org/jira/browse/HADOOP-18687
> Project: Hadoop Common
> Issue Type: Improvement
> Components: auth
> Affects Versions: 3.4.0, 3.3.5
> Reporter: Michiel de Jong
> Assignee: Michiel de Jong
> Priority: Major
> Labels: pull-request-available
> Fix For: 3.4.0
>
>
> hadoop-auth has a dependency on net.minidev:json-smart 2.4.7, but this
> dependency is never used.
> This dependency was originally included because the transitive dependency
> that nimbus-jose-jwt had did not work properly (see
> https://issues.apache.org/jira/browse/HADOOP-14903). Since version 9.*
> nimbus-jose-jwt is using its own shaded version of json-smart, so the version
> declared in hadoop-auth is never actually used.
> json-smart 2.4.7 shows up in CVE scans for CVE-2023-1370. It is still used as
> a transitive dependency in hadoop-hdfs
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
