InvisibleProgrammer commented on PR #6635: URL: https://github.com/apache/hive/pull/6635#issuecomment-5281286139
I think there are still a couple of steps to do: I just found out recently that jackson-databind has no explicit value set in Hive. I don't know the reason behind it and also have no idea how maven chooses which version should it pick up during the compilation process. Maybe because of that, I already found an older version of jackson brought into Hive. For example, in storage-api: ``` [INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.12.7.1:provided [INFO] | | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.12.7:provided [INFO] | | \- com.fasterxml.jackson.core:jackson-core:jar:2.12.7:provided ``` And I also, there are other jackson dependencies than jackson-core. I don't know the exact list of all of them but I think they should be upgraded as well to avoid bringing in the exact same CVE. As far I know, the version number of jackson-databind matches with jackson-core. Those are the questionable dependencies that I wrote about: ``` grep '+- com.fasterxml.jackson' deps.txt | grep -v '2.21.5' [INFO] | +- com.fasterxml.jackson.core:jackson-databind:jar:2.12.7.1:provided [INFO] | | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.12.7:provided [INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:provided [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile [INFO] | +- com.fasterxml.jackson.core:jackson-annotations:jar:2.21:compile ``` Note: I built Hive with `mvn clean install -DskipTests -DskipJavascript -T 1C -Pitests` so the dependencies of iTests is contained in my analysys but I'm not sure about other possible test modules. Maybe a full-build profile can deliver everything. I used `mvn dependency:tree > deps.txt` to gather the dependencies. Thanks, Zsolt -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
