[
https://issues.apache.org/jira/browse/SOLR-15355?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17431357#comment-17431357
]
Kevin Risden commented on SOLR-15355:
-------------------------------------
There are a bunch of changes between 3.2.0 and 3.2.2:
https://github.com/apache/hadoop/compare/rel/release-3.2.0...rel/release-3.2.2#diff-df2aa66a3757d73c93849b3a279d42a4634b0aed3550cdd2ead32d2fa06bf49eR176
The AWS Java SDK version definitely changed:
{code:java}
- <aws-java-sdk.version>1.11.375</aws-java-sdk.version>
+ <aws-java-sdk.version>1.11.563</aws-java-sdk.version>
{code}
I'm not sure if Solr uses the shaded Hadoop client libraries for cloud access
or ends up having to declare the AWS Java SDK version in use as well.
> CVE-2020-9492: Upgrade hadoop-hdfs-client to 3.2.2
> --------------------------------------------------
>
> Key: SOLR-15355
> URL: https://issues.apache.org/jira/browse/SOLR-15355
> Project: Solr
> Issue Type: Bug
> Components: hdfs, security
> Affects Versions: 8.6, 8.6.2
> Reporter: Nazerke Seidan
> Priority: Major
> Fix For: 8.10
>
> Time Spent: 1.5h
> Remaining Estimate: 0h
>
> CVE-2020-9492 vuln. issue is found in 8x component
> maven:org.apache.hadoop:hadoop-hdfs-client (version3.2.0) It seems with the
> version 3.2.0 hdfs client might send authorization header to remote url
> without verification.
> ([https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9492])
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@solr.apache.org
For additional commands, e-mail: issues-h...@solr.apache.org
