[
https://issues.apache.org/jira/browse/HIVE-26999?focusedWorklogId=851053&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-851053
]
ASF GitHub Bot logged work on HIVE-26999:
-----------------------------------------
Author: ASF GitHub Bot
Created on: 15/Mar/23 07:04
Start Date: 15/Mar/23 07:04
Worklog Time Spent: 10m
Work Description: devaspatikrishnatri commented on code in PR #3996:
URL: https://github.com/apache/hive/pull/3996#discussion_r1127788514
##########
standalone-metastore/pom.xml:
##########
@@ -365,8 +365,8 @@
<optional>true</optional>
</dependency>
<dependency>
- <groupId>mysql</groupId>
- <artifactId>mysql-connector-java</artifactId>
+ <groupId>com.mysql</groupId>
Review Comment:
We are not switching to a new library, the old one used to relocate to this
mysqlconnecotr/j version.
The my-sql-connector for 8.0.31 contains a relocation GAV to
my-sql-connector/j 8.0.31
original POM:
https://repo1.maven.org/maven2/mysql/mysql-connector-java/8.0.31/mysql-connector-java-8.0.31.pom
and i had already attached the depedency tree in the apache jira for this
change, no mention of mysql-connector-java is there.
##########
standalone-metastore/pom.xml:
##########
@@ -365,8 +365,8 @@
<optional>true</optional>
</dependency>
<dependency>
- <groupId>mysql</groupId>
- <artifactId>mysql-connector-java</artifactId>
+ <groupId>com.mysql</groupId>
Review Comment:
hope this is okay..?
Issue Time Tracking
-------------------
Worklog Id: (was: 851053)
Time Spent: 1h 20m (was: 1h 10m)
> Upgrade MySQL Connector Java due to security CVEs
> --------------------------------------------------
>
> Key: HIVE-26999
> URL: https://issues.apache.org/jira/browse/HIVE-26999
> Project: Hive
> Issue Type: Task
> Reporter: Devaspati Krishnatri
> Assignee: Devaspati Krishnatri
> Priority: Major
> Labels: pull-request-available
> Attachments: tree.txt
>
> Time Spent: 1h 20m
> Remaining Estimate: 0h
>
> The following CVEs impact older versions of [MySQL Connector
> Java|https://mvnrepository.com/artifact/mysql/mysql-connector-java]
> * *CVE-2021-3711* : Critical - Impacts all versions up to (including)
> 8.0.27 (ref: [https://nvd.nist.gov/vuln/detail/CVE-2021-3711])
> * *CVE-2021-3712* - High - Impacts all versions up to (including) 8.0.27
> (ref:
> [https://nvd.nist.gov/vuln/detail/CVE-2021-37112)|https://nvd.nist.gov/vuln/detail/CVE-2021-3711]
> * *CVE-2021-44531* - High - Impacts all versions up to (including) 8.0.28
> (ref: [https://nvd.nist.gov/vuln/detail/CVE-2021-44531])
> * *CVE-2022-21824* - High - Impacts all versions up to (including) 8.0.28
> (ref:[https://nvd.nist.gov/vuln/detail/CVE-2022-21824)]
> Recommendation: *Upgrade* [*MySQL Connector
> Java*|https://mvnrepository.com/artifact/mysql/mysql-connector-java] *to*
> [*8.0.31*|https://mvnrepository.com/artifact/mysql/mysql-connector-java/8.0.31]
> *or above*
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
