[
https://issues.apache.org/jira/browse/HADOOP-19782?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18135414#comment-18135414
]
Jose Angel Riarola commented on HADOOP-19782:
---------------------------------------------
Just filed a refresher PR.
It just bumps the versions, tested in our CI infra aswell and it works fine.
Upgrading to 1.1.10.12 will also address (although CVE-2026-108106 was my main
concern)
- CVE-2026-93451 — buffer overflow via typed uncompress methods
- CVE-2026-116590 — JVM crash from unchecked ranges in Snappy.arrayCopy /
SnappyOutputStream.rawWrite
Patch file: [^HADOOP-19782.001.patch]
> updated compression library versions for OSS
> --------------------------------------------
>
> Key: HADOOP-19782
> URL: https://issues.apache.org/jira/browse/HADOOP-19782
> Project: Hadoop Common
> Issue Type: Improvement
> Affects Versions: 3.4.2
> Reporter: Edward Capriolo
> Priority: Major
> Labels: pull-request-available
>
> Compression APIs need constant freshening:
> <snappy-java.version>1.1.10.4</snappy-java.version>
> <lz4-java.version>1.9.0</lz4-java.version>
> <snappy-java.version>1.1.10.8</snappy-java.version>
> <lz4-java.version>1.10.2</lz4-java.version>
>
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
