[
https://issues.apache.org/jira/browse/SPARK-39793?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Hyukjin Kwon resolved SPARK-39793.
----------------------------------
Resolution: Invalid
Resolving as Invalid — this is a usage/how-to question rather than a specific
Spark defect or actionable change. Usage questions are best directed to
[email protected] (https://spark.apache.org/community.html) or Stack
Overflow (tag apache-spark). Findings from triage: Verified at
/Users/hyukjin.kwon/workspace/forked/spark on master. The ticket is typed as a
"Question" and literally asks how to treat/eliminate a scanner-reported CVE
(CVE-2021-4048) for a bundled third-party jar (arpack_combined_all-0.1.jar). It
contains no reproducer, no failing behavior, and no proposed code change — it
is a security-triage/how-to question, which belongs on user@/dev@ or
[email protected], not a JIRA bug/improvement.
Evidence confirms the disposition rationale: graphx/pom.xml lines 67-70 still
declare net.sourceforge.f2j:arpack_combined_all:0.1 and dev/deps/spark-deps-ha
Please reopen with a concrete reproducer or a specific proposed change if this
is actually a bug or an actionable improvement.
> How to treat/eliminate CVE-2021-4048 (reported for
> arpack_combined_all-0.1.jar)
> -------------------------------------------------------------------------------
>
> Key: SPARK-39793
> URL: https://issues.apache.org/jira/browse/SPARK-39793
> Project: Spark
> Issue Type: Question
> Components: MLlib
> Affects Versions: 3.3.0
> Reporter: Alexander Bouriakov
> Priority: Major
>
> The following CVE is reported for arpack_combined_all-0.1.jar which is used
> in org.apache.spark:spark-graphx_2.13 which in turn is used in mllib :
> [https://nvd.nist.gov/vuln/detail/CVE-2021-4048]
> Questions: how relevant is this issue, can it be safely ignored?
> It seems that arpack_combined_all-0.1.jar is really needed because when
> removing it from the CLASSPATH, a NoClassDefFoundError: org/netlib/blas/Sdot
> is reported.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
