[
https://issues.apache.org/jira/browse/SPARK-45590?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Kent Yao resolved SPARK-45590.
------------------------------
Fix Version/s: 3.5.3
Resolution: Fixed
Issue resolved by pull request 47769
[https://github.com/apache/spark/pull/47769]
> okio-1.15.0 CVE-2023-3635
> -------------------------
>
> Key: SPARK-45590
> URL: https://issues.apache.org/jira/browse/SPARK-45590
> Project: Spark
> Issue Type: Task
> Components: Build
> Affects Versions: 3.4.0, 3.5.0, 4.0.0
> Reporter: Colm O hEigeartaigh
> Assignee: Gabor Roczei
> Priority: Minor
> Labels: pull-request-available
> Fix For: 3.5.3
>
>
> CVE-2023-3635 is being flagged against okio-1.15.0 present in the Spark 3.5.0
> build:
> * ./spark-3.5.0-bin-without-hadoop/jars/okio-1.15.0.jar
> * ./spark-3.5.0-bin-hadoop3/jars/okio-1.15.0.jar
> I don't see okio in the dependency tree, it must be coming in via some
> profile.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
