[
https://issues.apache.org/jira/browse/HIVE-28438?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Shohei Okumiya resolved HIVE-28438.
-----------------------------------
Fix Version/s: 4.1.0
Resolution: Fixed
I resolved this one with fix version = 4.1.0, as it has been merged. cc:
[~zhangbutao]
https://github.com/apache/hive/pull/5385
> Remove commons-pool2 as an explicit dependency & upgrade commons-dbcp2 to
> 2.12.0
> --------------------------------------------------------------------------------
>
> Key: HIVE-28438
> URL: https://issues.apache.org/jira/browse/HIVE-28438
> Project: Hive
> Issue Type: Improvement
> Reporter: tanishqchugh
> Assignee: tanishqchugh
> Priority: Major
> Labels: pull-request-available
> Fix For: 4.1.0
>
>
> In the master branch, currently we are using commons-dbcp2 v2.9.0 which is
> affected by following CVEs:
> [CVE-2022-45868|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45868]
> [CVE-2022-23221|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23221]
> [CVE-2021-42392|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42392]
> [CVE-2021-23463|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23463]
> commons-pool2 is not a direct dependency to hive and is only required by
> commons-dbcp2 as a compile time dependency which comes in transitively with
> commons-dbcp2 itself. Thus, removing commons-pool2 which is currently listed
> as an explicit dependency.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
