[GitHub] [hadoop] virajjasani commented on pull request #2932: HADOOP-17649. Upgrade wildfly openssl to 2.1.3.Final due to security vulnerabilities

2021-04-19 Thread GitBox
virajjasani commented on pull request #2932: URL: https://github.com/apache/hadoop/pull/2932#issuecomment-822431445 Before creating this PR, local build went well. Hence I raised PR and since we have updated License-binary file, we will have full QA build taking 17+ hr worth of time. Hopef

[GitHub] [hadoop] virajjasani commented on pull request #2932: HADOOP-17649. Upgrade wildfly openssl to 2.1.3.Final due to security vulnerabilities

2021-04-20 Thread GitBox
virajjasani commented on pull request #2932: URL: https://github.com/apache/hadoop/pull/2932#issuecomment-823055329 For the consistently failing tests, I see mostly timeout issues. As for the release notes of wildfly-openssl 2.x, it's not apparently well accessible. I tried looking into th

[GitHub] [hadoop] virajjasani commented on pull request #2932: HADOOP-17649. Upgrade wildfly openssl to 2.1.3.Final due to security vulnerabilities

2021-04-22 Thread GitBox
virajjasani commented on pull request #2932: URL: https://github.com/apache/hadoop/pull/2932#issuecomment-824987122 > The reason we use wildfly in the azure and -aws JARs is for performance by picking up those native bindings. if you use wildfly ssl as your socket factory, when openssl bin

[GitHub] [hadoop] virajjasani commented on pull request #2932: HADOOP-17649. Upgrade wildfly openssl to 2.1.3.Final due to security vulnerabilities

2021-04-22 Thread GitBox
virajjasani commented on pull request #2932: URL: https://github.com/apache/hadoop/pull/2932#issuecomment-824996410 Btw, the main reason behind this upgrade is CVE: https://nvd.nist.gov/vuln/detail/CVE-2020-25644 ``` A memory leak flaw was found in WildFly OpenSSL in versions prior to

[GitHub] [hadoop] virajjasani commented on pull request #2932: HADOOP-17649. Upgrade wildfly openssl to 2.1.3.Final due to security vulnerabilities

2021-05-01 Thread GitBox
virajjasani commented on pull request #2932: URL: https://github.com/apache/hadoop/pull/2932#issuecomment-830580979 @steveloughran If you suggest to not move forward due to the possibility of regression in Azure and AWS Jars, I can close this PR and maybe we can give this a shot later, pro