[
https://issues.apache.org/jira/browse/HIVE-26999?focusedWorklogId=849445&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-849445
]
ASF GitHub Bot logged work on HIVE-26999:
-----------------------------------------
Author: ASF GitHub Bot
Created on: 07/Mar/23 04:09
Start Date: 07/Mar/23 04:09
Worklog Time Spent: 10m
Work Description: saihemanth-cloudera commented on code in PR #3996:
URL: https://github.com/apache/hive/pull/3996#discussion_r1127320420
##########
standalone-metastore/pom.xml:
##########
@@ -365,8 +365,8 @@
<optional>true</optional>
</dependency>
<dependency>
- <groupId>mysql</groupId>
- <artifactId>mysql-connector-java</artifactId>
+ <groupId>com.mysql</groupId>
Review Comment:
After switching to a new library, are these still valid?
https://github.com/apache/hive/blob/master/druid-handler/pom.xml#L187
https://github.com/apache/hive/blob/master/packaging/src/main/assembly/bin.xml#L53
Issue Time Tracking
-------------------
Worklog Id: (was: 849445)
Time Spent: 1h (was: 50m)
> Upgrade MySQL Connector Java due to security CVEs
> --------------------------------------------------
>
> Key: HIVE-26999
> URL: https://issues.apache.org/jira/browse/HIVE-26999
> Project: Hive
> Issue Type: Task
> Reporter: Devaspati Krishnatri
> Assignee: Devaspati Krishnatri
> Priority: Major
> Labels: pull-request-available
> Attachments: tree.txt
>
> Time Spent: 1h
> Remaining Estimate: 0h
>
> The following CVEs impact older versions of [MySQL Connector
> Java|https://mvnrepository.com/artifact/mysql/mysql-connector-java]
> * *CVE-2021-3711* : Critical - Impacts all versions up to (including)
> 8.0.27 (ref: [https://nvd.nist.gov/vuln/detail/CVE-2021-3711])
> * *CVE-2021-3712* - High - Impacts all versions up to (including) 8.0.27
> (ref:
> [https://nvd.nist.gov/vuln/detail/CVE-2021-37112)|https://nvd.nist.gov/vuln/detail/CVE-2021-3711]
> * *CVE-2021-44531* - High - Impacts all versions up to (including) 8.0.28
> (ref: [https://nvd.nist.gov/vuln/detail/CVE-2021-44531])
> * *CVE-2022-21824* - High - Impacts all versions up to (including) 8.0.28
> (ref:[https://nvd.nist.gov/vuln/detail/CVE-2022-21824)]
> Recommendation: *Upgrade* [*MySQL Connector
> Java*|https://mvnrepository.com/artifact/mysql/mysql-connector-java] *to*
> [*8.0.31*|https://mvnrepository.com/artifact/mysql/mysql-connector-java/8.0.31]
> *or above*
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
