InvisibleProgrammer opened a new pull request, #6926:
URL: https://github.com/apache/hive/pull/6926
Upgrade pac4j to 6.6.0 to fix CVE-2026-40458
### What changes were proposed in this pull request?
Upgrades pac4j from 4.5.8 to 6.6.0 to fix CVE-2026-40458. pac4j is used for
SAML SSO in HiveServer2 (service) and for JWT bearer-token extraction in the
HMS servlet (standalone-metastore).
Dependency changes
- pac4j-saml.version and pac4j-core.version: 4.5.8 → 6.6.0.
- xmlsec.version: 2.3.4 → 4.0.4, the version the new pac4j-saml stack
expects.
- The pac4j-saml-opensamlv3 artifact no longer exists in pac4j 6, so it is
replaced by pac4j-saml.
- New pac4j-javaee dependency in the root dependencyManagement, service, and
metastore-server. JEEContext and the JEE session store moved out of pac4j-core
into this module. It uses the same * exclusion pattern as the existing pac4j
entries.
API migration for pac4j 6
- JEEContext moved from org.pac4j.core.context to org.pac4j.jee.context. It
is now paired with JEESessionStore inside a CallContext.
- HiveSaml2Client:
- Redirect creation now takes a CallContext.
- validate() no longer instantiates SAML2CredentialsExtractor directly. It
uses the client's getCredentialsExtractor(), then runs validateCredentials(...)
on the result. In pac4j 6, the extraction step only parses the response, and
this second step performs the SAML validation.
- It now works with SAML2AuthenticationCredentials instead of
SAML2Credentials.
- HiveSamlGroupNameFilter: SAMLAttribute import moved to
SAML2AuthenticationCredentials.
- HiveSamlRelayStateStore: ValueGenerator#generateValue now takes a
CallContext, so the web context is read from it.
- ThriftHttpServlet and ServletSecurity: BearerAuthExtractor.extract now
takes a CallContext and returns Optional<Credentials>, so the result is cast to
TokenCredentials before reading the token.
### Why are the changes needed?
pac4j 4.5.8 is affected by CVE-2026-40458. The fix is only available io this
requires moving to pac4j 6.x and adapting to its API changes.
### Does this PR introduce _any_ user-facing change?
No
### How was this patch tested?
With the existing test suite.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
