[ https://issues.apache.org/jira/browse/SPARK-27469?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Sean Owen resolved SPARK-27469. ------------------------------- Resolution: Fixed Fix Version/s: 3.0.0 Resolved by https://github.com/apache/spark/pull/24378 > Update Commons BeanUtils to 1.9.3 > --------------------------------- > > Key: SPARK-27469 > URL: https://issues.apache.org/jira/browse/SPARK-27469 > Project: Spark > Issue Type: Improvement > Components: Spark Core > Affects Versions: 2.4.1, 3.0.0 > Reporter: Sean Owen > Assignee: Sean Owen > Priority: Minor > Fix For: 3.0.0 > > > Right now, Spark inherits two incosistent versions of Commons BeanUtils via > Hadoop: commons-beanutils 1.7.0 and commons-beanutils-core 1.8.0. Version > 1.9.3 is the latest, and resolves bugs and a deserialization vulnerability > that was otherwise resolved here in CVE-2017-12612. It'd be nice to both fix > the inconsistency and get the latest to further ensure that there isn't any > latent vulnerability here. -- This message was sent by Atlassian JIRA (v7.6.3#76005) --------------------------------------------------------------------- To unsubscribe, e-mail: issues-unsubscr...@spark.apache.org For additional commands, e-mail: issues-h...@spark.apache.org