[ 
https://issues.apache.org/jira/browse/HBASE-20582?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16477432#comment-16477432
 ] 

Josh Elser commented on HBASE-20582:
------------------------------------

{quote}I think we have already shaded the jackson dependency so it will not 
effect users if we upgrade it?
{quote}
You're right that the shaded-client protects users, but those who use the 
tried-and-true hbase-client will still see the bump. The Jackson release notes 
claim compatibility, but history has convinced us that we shouldnt' trust 
Jackson :)
{quote}And for JRuby, we only use it in our shell so it is OK to upgrade it? We 
do not expect users to add a hbase-shell dependency in their pom?
{quote}
JRuby definitely is of little concern to me for compat. Just wanted to 
double-check with you before landing in a minor-release (didn't know how 
aggressive you wanted to get a hand on things) ;)

> Bump up the Jackson and Jruby version because of some reported vulnerabilities
> ------------------------------------------------------------------------------
>
>                 Key: HBASE-20582
>                 URL: https://issues.apache.org/jira/browse/HBASE-20582
>             Project: HBase
>          Issue Type: Bug
>            Reporter: Ankit Singhal
>            Assignee: Ankit Singhal
>            Priority: Major
>             Fix For: 2.1.0
>
>         Attachments: HBASE-20582.patch
>
>
> There are some vulnerabilities reported with two of the libraries used in 
> HBase.
> {code}
> Jackson(version:2.9.2):
> CVE-2017-17485
> CVE-2018-5968
> CVE-2018-7489
> Jruby(version:9.1.10.0):
> CVE-2009-5147
> CVE-2013-4363
> CVE-2014-4975
> CVE-2014-8080
> CVE-2014-8090
> CVE-2015-3900
> CVE-2015-7551
> CVE-2015-9096
> CVE-2017-0899
> CVE-2017-0900
> CVE-2017-0901
> CVE-2017-0902
> CVE-2017-0903
> CVE-2017-10784
> CVE-2017-14064
> CVE-2017-9224
> CVE-2017-9225
> CVE-2017-9226
> CVE-2017-9227
> CVE-2017-9228
> {code}
> Tool somehow able to relate the vulnerability of Ruby with JRuby(Java 
> implementation).
> Not all of them directly affects HBase but [~elserj] suggested that it is 
> better to be on the updated version to avoid issues during an audit in 
> security sensitive organization.
>  



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Reply via email to