[
https://issues.apache.org/jira/browse/HBASE-27921?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sercan Tekin updated HBASE-27921:
---------------------------------
Description:
Current version of `jruby` (9.3.9.0) has snakeyaml dependency version 1.33.
{code:java}
> find ./jruby-complete-9.3.9.0/ -name "*snakeyaml*"
./jruby-complete-9.3.9.0/META-INF/jruby.home/lib/ruby/stdlib/org/yaml/snakeyaml
./jruby-complete-9.3.9.0/META-INF/jruby.home/lib/ruby/stdlib/org/yaml/snakeyaml/1.33/snakeyaml-1.33.jar
{code}
`snakeyaml-1.33` has a critical CVE
[https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1471]
jruby
was:Current version of
> Bump up jruby to 9.4.2.0 and related joni and jcodings to 2.1.48 and 1.0.58
> respectively
> ----------------------------------------------------------------------------------------
>
> Key: HBASE-27921
> URL: https://issues.apache.org/jira/browse/HBASE-27921
> Project: HBase
> Issue Type: Bug
> Reporter: Sercan Tekin
> Priority: Major
>
> Current version of `jruby` (9.3.9.0) has snakeyaml dependency version 1.33.
> {code:java}
> > find ./jruby-complete-9.3.9.0/ -name "*snakeyaml*"
> ./jruby-complete-9.3.9.0/META-INF/jruby.home/lib/ruby/stdlib/org/yaml/snakeyaml
> ./jruby-complete-9.3.9.0/META-INF/jruby.home/lib/ruby/stdlib/org/yaml/snakeyaml/1.33/snakeyaml-1.33.jar
> {code}
> `snakeyaml-1.33` has a critical CVE
> [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1471]
> jruby
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
