[ https://issues.apache.org/jira/browse/HBASE-25755?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Peter Somogyi updated HBASE-25755: ---------------------------------- Status: Patch Available (was: Open) > Exclude tomcat-embed-core from libthrift > ---------------------------------------- > > Key: HBASE-25755 > URL: https://issues.apache.org/jira/browse/HBASE-25755 > Project: HBase > Issue Type: Task > Components: dependencies, Thrift > Affects Versions: 2.3.5, 3.0.0-alpha-1, 2.2.7, 2.5.0, 2.4.3 > Reporter: Peter Somogyi > Assignee: Peter Somogyi > Priority: Critical > > HBASE-25568 upgraded the Thrift dependency to 0.14.1 to fix a known CVE but a > dependency issue in libthrift brings in tomcat-embed-core which has many > vulnerabilities. See: THRIFT-5375 > Since this dependency is used in Thrift only for a test we can safely exclude > it inside HBase. -- This message was sent by Atlassian Jira (v8.3.4#803005)