Stamatis Zampetakis created HIVE-25945:
------------------------------------------
Summary: Upgrade H2 database version to 2.1.210
Key: HIVE-25945
URL: https://issues.apache.org/jira/browse/HIVE-25945
Project: Hive
Issue Type: Task
Components: Testing Infrastructure
Reporter: Stamatis Zampetakis
Assignee: Stamatis Zampetakis
The 1.3.166 version, which is in use in Hive, suffers from the following
security vulnerabilities:
https://nvd.nist.gov/vuln/detail/CVE-2021-42392
https://nvd.nist.gov/vuln/detail/CVE-2022-23221
In the project, we use H2 only for testing purposes (inside the jdbc-handler
module) thus the H2 binaries are not present in the runtime classpath thus
these CVEs do not pose a problem for Hive or its users. Nevertheless, it would
be good to upgrade to a more recent version to avoid Hive coming up in
vulnerability scans due to this.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
