Colm O hEigeartaigh created SPARK-45590:
-------------------------------------------
Summary: okio-1.15.0 CVE-2023-3635
Key: SPARK-45590
URL: https://issues.apache.org/jira/browse/SPARK-45590
Project: Spark
Issue Type: Task
Components: Build
Affects Versions: 3.5.0
Reporter: Colm O hEigeartaigh
CVE-2023-3635 is being flagged against okio-1.15.0 present in the Spark 3.5.0
build:
* ./spark-3.5.0-bin-without-hadoop/jars/okio-1.15.0.jar
* ./spark-3.5.0-bin-hadoop3/jars/okio-1.15.0.jar
I don't see okio in the dependency tree, it must be coming in via some profile.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@spark.apache.org
For additional commands, e-mail: issues-h...@spark.apache.org
