aarushigupta132 opened a new pull request, #8954: URL: https://github.com/apache/hadoop/pull/8954
### Description of PR Upgrade Apache Kerby from 2.0.3 to 2.1.2, which fixes the published Kerby pre-authentication bypass [CVE-2026-57915](https://www.openwall.com/lists/oss-security/2026/06/26/8). Manage `kerby-asn1` and `kerby-pkix` at the same version so Solr's direct dependencies do not select older Kerby artifacts. Update the 15 Kerby entries in `LICENSE-binary` and the Kerby notice in `NOTICE-binary`. Include that notice in the root `NOTICE.txt`, which the shaded client runtime and minicluster JARs already package. This is a dependency upgrade against current `trunk`. It does not claim a demonstrated vulnerability in Hadoop. The earlier [#8710](https://github.com/apache/hadoop/pull/8710) targeted the frozen 3.3.4 branch and was closed without merging. Draft pending a HADOOP Jira issue and validation. No matching Jira issue was found; Jira authentication is unavailable to the submitter's tooling. ### How was this patch tested? - POM XML parses and `git diff --check` passes. - Targeted `TestMiniKdc` and `TestKerberosUtil` tests are pending on this branch. - Full distribution and native builds have not been run. ### For code changes: - [ ] Does the title start with the corresponding JIRA issue id? Pending issue creation. - Object-storage integration tests: not applicable. - [x] Dependency licenses remain Apache License 2.0. - [x] Updated `LICENSE-binary`, `NOTICE-binary`, and `NOTICE.txt`. ### AI Tooling Contains content generated by Codex. - [x] The PR declares the AI tool used. - [x] AI contributions follow the [ASF generative tooling policy](https://www.apache.org/legal/generative-tooling.html). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
