[
https://issues.apache.org/jira/browse/HBASE-24802?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17199742#comment-17199742
]
Sean Busbey commented on HBASE-24802:
-------------------------------------
[~Esalnikov] I believe the analogous Hadoop jira is HADOOP-17171 but it looks
like that isn't going anywhere.
my WIP on PR 36 will eventually need to work at runtime with some set of Hadoop
versions we want HBase to run on without hassle. Arbitrary Hadoop versions or
non-HBase uses of Hadoop won't be first-class priorities, but my guess is
whatever drop-in replacement HBase comes up with will be your best bet.
> Please fix CVEs by removing reference to htrace-core4
> -----------------------------------------------------
>
> Key: HBASE-24802
> URL: https://issues.apache.org/jira/browse/HBASE-24802
> Project: HBase
> Issue Type: Bug
> Components: Client, dependencies, thirdparty
> Affects Versions: 1.4.0, 2.2.0, 2.3.0, 1.6.0
> Reporter: Rodney Aaron Stainback
> Assignee: Sean Busbey
> Priority: Critical
>
> htrace-core4 is a retired project and even on the latest version they Shade
> Jackson databind version 2.4.0 which has the following CVEs:
> |cve|severity|cvss|
> |CVE-2017-15095|critical|9.8|
> |CVE-2018-1000873|medium|6.5|
> |CVE-2018-14718|critical|9.8|
> |CVE-2018-5968|high|8.1|
> |CVE-2018-7489|critical|9.8|
> |CVE-2019-14540|critical|9.8|
> |CVE-2019-14893|critical|9.8|
> |CVE-2019-16335|critical|9.8|
> |CVE-2019-16942|critical|9.8|
> |CVE-2019-16943|critical|9.8|
> |CVE-2019-17267|critical|9.8|
> |CVE-2019-17531|critical|9.8|
> |CVE-2019-20330|critical|9.8|
> |CVE-2020-10672|high|8.8|
> |CVE-2020-10673|high|8.8|
> |CVE-2020-10968|high|8.8|
> |CVE-2020-10969|high|8.8|
> |CVE-2020-11111|high|8.8|
> |CVE-2020-11112|high|8.8|
> |CVE-2020-11113|high|8.8|
> |CVE-2020-11619|critical|9.8|
> |CVE-2020-11620|critical|9.8|
> |CVE-2020-14060|high|8.1|
> |CVE-2020-14061|high|8.1|
> |CVE-2020-14062|high|8.1|
> |CVE-2020-14195|high|8.1|
> |CVE-2020-8840|critical|9.8|
> |CVE-2020-9546|critical|9.8|
> |CVE-2020-9547|critical|9.8|
> |CVE-2020-9548|critical|9.8|
>
> Our security team is trying to block us from using hbase because of this
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
