Abhay created HIVE-24890:
----------------------------
Summary: Upgrade to cron-utils 9.1.3 due to CVE-2020-26238
Key: HIVE-24890
URL: https://issues.apache.org/jira/browse/HIVE-24890
Project: Hive
Issue Type: Bug
Environment: [CVE
2020-26238|https://nvd.nist.gov/vuln/detail/CVE-2020-26238]
Reporter: Abhay
Assignee: Abhay
Hive is pulling in cron-utils 8.1.1 which is vulnerable to CVE-2020-26238. It
is assigned a CVSSv3 score of Critical. For reference here is where cron-utils
is referenced in code:
*
[https://github.com/apache/hive/blob/master/standalone-metastore/pom.xml#L107]
Upgrade cron-utils to 9.1.3 which is not vulnerable to this CVE even if Hive is
not technically vulnerable.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
