Abhay created HIVE-25054: ---------------------------- Summary: Upgrade jodd-core due to CVE-2018-21234 Key: HIVE-25054 URL: https://issues.apache.org/jira/browse/HIVE-25054 Project: Hive Issue Type: Bug Components: Build Infrastructure Affects Versions: 3.1.2 Reporter: Abhay Assignee: Abhay
Hive makes use of 3.5.2 version of the `jodd-core` library which is susceptible to CVE-2018-21234. Below is a description of that vulnerability. CVE-2018-21234 suppress Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set. CWE-502 Deserialization of Untrusted Data CVSSv2: Base Score: HIGH (7.5) Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P CVSSv3: Base Score: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References: MISC - https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16MISC - https://github.com/oblac/jodd/compare/v5.0.3...v5.0.4MISC - https://github.com/oblac/jodd/issues/628Vulnerable Software & Versions: cpe:2.3:a:jodd:jodd:*:*:*:*:*:*:*:* versions up to (excluding) 5.0.4 This library needs to be upgraded. We use a couple of classes `JDateTime`([https://github.infra.cloudera.com/CDH/hive/blob/cdpd-master/ql/src/java/org/apache/hadoop/hive/ql/io/parquet/timestamp/NanoTimeUtils.java] ) and `HtmlEncoder`, which have either been deprecated and/or have been moved to a different package called jodd-util. -- This message was sent by Atlassian Jira (v8.3.4#803005)