[jira] [Commented] (HDFS-16777) datatables@1.10.17 sonatype-2020-0988 vulnerability

[ASF GitHub Bot (Jira)]

    [ 
https://issues.apache.org/jira/browse/HDFS-16777?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17615931#comment-17615931
 ] 

ASF GitHub Bot commented on HDFS-16777:
---------------------------------------

ashutoshcipher commented on PR #5003:
URL: https://github.com/apache/hadoop/pull/5003#issuecomment-1274931054

   Verified NameNode dfshealth.html and explorer.html
   
   <img width="1787" alt="Screenshot 2022-10-11 at 16 54 53" 
src="https://user-images.githubusercontent.com/17571497/195142116-49cbfdf5-343a-47f9-b793-f2b0f969c047.png";>
   <img width="1783" alt="Screenshot 2022-10-11 at 16 52 13" 
src="https://user-images.githubusercontent.com/17571497/195142122-ba4b0d86-2a22-4f40-ac51-c024c59491d7.png";>
   




> datatables@1.10.17  sonatype-2020-0988 vulnerability
> ----------------------------------------------------
>
>                 Key: HDFS-16777
>                 URL: https://issues.apache.org/jira/browse/HDFS-16777
>             Project: Hadoop HDFS
>          Issue Type: Bug
>          Components: ui
>    Affects Versions: 3.3.4
>            Reporter: Eugene Shinn (Truveta)
>            Assignee: Ashutosh Gupta
>            Priority: Major
>              Labels: pull-request-available
>
> Our static analysis security tool detected that HDFS's UI currently includes 
> a vulnerable version of datatables detected by Sonatype (sonatype-2020-0988). 
> From the vulnerability description:
> _"The `datatables.net` package is vulnerable to Prototype Pollution. The 
> `setData` function in `jquery.dataTables.js` fails to protect prototype 
> attributes when objects are created during the application's execution. A 
> remote attacker can exploit this to modify the behavior of object prototypes 
> which, depending on their use in the application, may result in a Denial of 
> Service (DoS), Remote Code Execution (RCE), or other unexpected execution 
> flow."_
> This issue was addressed in v 1.11.5 (ref: [Fix: Protect developers from 
> inadvertantely introducing prototype pol… · 
> DataTables/Dist-DataTables@e2e19ea 
> (github.com)).|https://github.com/DataTables/Dist-DataTables/commit/e2e19eac7e5a6f140d7eefca5c7deba165b357eb#diff-e7d8309f017dd2ef6385fa8cdc1539a2R2765]
> N.B. this issue was also detected within the YARN UI as well.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: hdfs-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: hdfs-issues-h...@hadoop.apache.org