Naveen Gangam created HIVE-26566:
------------------------------------
Summary: Upgrade H2 database version to 2.1.214
Key: HIVE-26566
URL: https://issues.apache.org/jira/browse/HIVE-26566
Project: Hive
Issue Type: Task
Components: Testing Infrastructure
Reporter: Stamatis Zampetakis
Assignee: Stamatis Zampetakis
Fix For: 4.0.0, 4.0.0-alpha-1
The 1.3.166 version, which is in use in Hive, suffers from the following
security vulnerabilities:
https://nvd.nist.gov/vuln/detail/CVE-2021-42392
https://nvd.nist.gov/vuln/detail/CVE-2022-23221
In the project, we use H2 only for testing purposes (inside the jdbc-handler
module) thus the H2 binaries are not present in the runtime classpath thus
these CVEs do not pose a problem for Hive or its users. Nevertheless, it would
be good to upgrade to a more recent version to avoid Hive coming up in
vulnerability scans due to this.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
