[
https://issues.apache.org/jira/browse/RATIS-294?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16624149#comment-16624149
]
Tsz Wo Nicholas Sze commented on RATIS-294:
-------------------------------------------
r294_20180921.patch: updates hadoop.version to 3.1.1
> Fix ratis-hadoop CVEs
> ---------------------
>
> Key: RATIS-294
> URL: https://issues.apache.org/jira/browse/RATIS-294
> Project: Ratis
> Issue Type: Improvement
> Components: HadoopRPC
> Reporter: Tsz Wo Nicholas Sze
> Priority: Blocker
> Labels: ozone
> Attachments: r294_20180921.patch
>
>
> There are multiple CVEs found in ratis-hadoop.
> - CVE-2012-4449 | High org.apache.ratis:ratis-hadoop:0.3.0-SNAPSHOT
> - CVE-2016-5001 | Low org.apache.ratis:ratis-hadoop:0.3.0-SNAPSHOT
> - CVE-2017-3161 | Medium org.apache.ratis:ratis-hadoop:0.3.0-SNAPSHOT
> - CVE-2017-3162 | High org.apache.ratis:ratis-hadoop:0.3.0-SNAPSHOT
> It is very likely that the CVEs come from the Hadoop dependency. We should
> either update the Hadoop version or temporarily remove Hadoop dependency in
> order to fix the CVEs.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
