[
https://issues.apache.org/jira/browse/HBASE-27921?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17730305#comment-17730305
]
Sercan Tekin commented on HBASE-27921:
--------------------------------------
Created a PR — [https://github.com/apache/hbase/pull/5274]
> Bump up jruby to 9.4.2.0 and related joni and jcodings to 2.1.48 and 1.0.58
> respectively
> ----------------------------------------------------------------------------------------
>
> Key: HBASE-27921
> URL: https://issues.apache.org/jira/browse/HBASE-27921
> Project: HBase
> Issue Type: Bug
> Reporter: Sercan Tekin
> Priority: Major
> Labels: jruby, security, shell
>
> Current version of *jruby* (9.3.9.0) has snakeyaml dependency version 1.33.
> {code:java}
> > find ./jruby-complete-9.3.9.0/ -name "*snakeyaml*"
> ./jruby-complete-9.3.9.0/META-INF/jruby.home/lib/ruby/stdlib/org/yaml/snakeyaml
> ./jruby-complete-9.3.9.0/META-INF/jruby.home/lib/ruby/stdlib/org/yaml/snakeyaml/1.33/snakeyaml-1.33.jar
> {code}
> *snakeyaml-1.33* has a critical CVE
> [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1471]
> *jruby-complete-9.4.2.0* uses {*}snakeyaml-engine-2.6{*}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
