[ https://issues.apache.org/jira/browse/SPARK-39183?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17536800#comment-17536800 ]
Apache Spark commented on SPARK-39183: -------------------------------------- User 'bjornjorgensen' has created a pull request for this issue: https://github.com/apache/spark/pull/36544 > Upgrade Apache Xerces Java to 2.12.2 > ------------------------------------ > > Key: SPARK-39183 > URL: https://issues.apache.org/jira/browse/SPARK-39183 > Project: Spark > Issue Type: Dependency upgrade > Components: Build > Affects Versions: 3.4.0 > Reporter: Bjørn Jørgensen > Priority: Major > > [Infinite Loop in Apache Xerces Java > |https://github.com/advisories/GHSA-h65f-jvqw-m9fj] > There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser > when handling specially crafted XML document payloads. This causes, the > XercesJ XML parser to wait in an infinite loop, which may sometimes consume > system resources for prolonged duration. This vulnerability is present within > XercesJ version 2.12.1 and the previous versions. > References > https://nvd.nist.gov/vuln/detail/CVE-2022-23437 > https://lists.apache.org/thread/6pjwm10bb69kq955fzr1n0nflnjd27dl > http://www.openwall.com/lists/oss-security/2022/01/24/3 > https://www.oracle.com/security-alerts/cpuapr2022.html -- This message was sent by Atlassian Jira (v8.20.7#820007) --------------------------------------------------------------------- To unsubscribe, e-mail: issues-unsubscr...@spark.apache.org For additional commands, e-mail: issues-h...@spark.apache.org