anupamme opened a new issue, #57794:
URL: https://github.com/apache/spark/issues/57794
Spark pins okhttp and okio in hadoop-cloud/pom.xml at 3.12.12 and 1.17.6
respectively. Both are declared under ${huaweicloud.deps.scope} and reach
the classpath only through the hadoop-huaweicloud (OBS) connector; Spark
has no direct okhttp usage.
okhttp 3.12.12 is flagged by CVE-2021-0341 (hostname verification in
OkHostnameVerifier). Exploitation requires an attacker already in an MITM
position holding a valid certificate for another host, so real exposure for
Spark is limited to the OBS path. The advisory lists 4.9.2 as the only fixed
release, so there is no remedy within the 3.x line.
A naive bump to 4.9.2 is a net regression: okhttp 4.x is Kotlin and pulls in
kotlin-stdlib 1.4.10 (CVE-2020-29582, CVE-2022-24329), and it requires okio
2.x, which is still exposed to CVE-2023-3635 — a CVE that the currently
pinned okio 1.17.6 already fixes in the 1.x line.
This ticket therefore proposes moving to current versions rather than minimum
patched ones, so that the net advisory count decreases:
okhttp 3.12.12 -> 4.12.0
okio 1.17.6 -> 3.9.x (CVE-2023-3635 fixed in 3.4.0)
kotlin-stdlib (new) -> 1.9.x (past both advisories above)
Scope of work:
- Update version properties in hadoop-cloud/pom.xml.
- Regenerate dev/deps/spark-deps-hadoop-3-hive-2.3. Note that okio 3.x
resolves through the okio-jvm artefact, so this is not a straight rename.
- Add kotlin-stdlib entries to LICENSE-binary and NOTICE-binary (Apache-2.0).
- Verify the OBS SDK used by hadoop-huaweicloud is compatible with okhttp
4.x.
This is not a backport candidate: Spark is not meaningfully affected on
supported default paths.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
