[ https://issues.apache.org/jira/browse/HADOOP-17844?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17701778#comment-17701778 ]
ASF GitHub Bot commented on HADOOP-17844: ----------------------------------------- steveloughran commented on PR #3299: URL: https://github.com/apache/hadoop/pull/3299#issuecomment-1473898361 this is 3.3.5; looks like nimbus-jose has it; the client jar simply includes that ``` version=2.4.7 ./share/hadoop/common/lib/json-smart-2.4.7.jar version=1.3.2 ./share/hadoop/common/lib/nimbus-jose-jwt-9.8.1.jar version=2.4.7 ./share/hadoop/hdfs/lib/json-smart-2.4.7.jar version=1.3.2 ./share/hadoop/hdfs/lib/nimbus-jose-jwt-9.8.1.jar version=1.3.2 ./share/hadoop/client/hadoop-client-runtime-3.3.5.jar ``` @degant feel free to start work on a patch to upgrade nimbus-jose-jwt. If you could show that this introduced any server-side vulnerabilities, that would help. > Upgrade JSON smart to 2.4.7 > --------------------------- > > Key: HADOOP-17844 > URL: https://issues.apache.org/jira/browse/HADOOP-17844 > Project: Hadoop Common > Issue Type: Bug > Reporter: Renukaprasad C > Assignee: Renukaprasad C > Priority: Major > Labels: pull-request-available > Fix For: 3.4.0, 3.2.3, 3.3.2 > > Time Spent: 1h 40m > Remaining Estimate: 0h > > Currently we are using JSON Smart 2.4.2 version which is vulnerable to - > CVE-2021-31684. > We can upgrade the version to 2.4.7 (2.4.5 or later). -- This message was sent by Atlassian Jira (v8.20.10#820010) --------------------------------------------------------------------- To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: common-issues-h...@hadoop.apache.org