Skip to content

HBASE-27423 Upgrade Jackson for CVE-2022-42003/42004 - #4821

Closed
apurtell wants to merge 1 commit into
apache:masterfrom
apurtell:HBASE-27423
Closed

HBASE-27423 Upgrade Jackson for CVE-2022-42003/42004#4821
apurtell wants to merge 1 commit into
apache:masterfrom
apurtell:HBASE-27423

Conversation

@apurtell

@apurtellapurtell commented Oct 11, 2022

Copy link
Copy Markdown
Contributor

Jackson 2.13.4 fixes CVE-2022-42004 and databind 2.14.0-rc1 fixes CVE-2022-42003.

Move jackson.version to 2.13.4.
Move jackson.databind.version to 2.14.0-rc1.

@apurtell
apurtell requested a review from Apache9October 11, 2022 00:36
Jackson 2.13.4 fixes CVE-2022-42004 and databind 2.14.0-rc1 fixes CVE-2022-42003.
Move jackson.version to 2.13.4.
Move jackson.databind.version to 2.14.0-rc1.
@Apache-HBase

Copy link
Copy Markdown

🎊 +1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec1m 1sDocker mode activated.
_ Prechecks _
+1 💚dupname0m 0sNo case conflicting files found.
+1 💚@author0m 0sThe patch does not contain any @author tags.
_ master Compile Tests _
+1 💚mvninstall2m 19smaster passed
+1 💚compile6m 21smaster passed
+1 💚spotless0m 40sbranch has no errors when running spotless:check.
_ Patch Compile Tests _
+1 💚mvninstall2m 7sthe patch passed
+1 💚compile6m 26sthe patch passed
-0 ⚠️javac6m 26sroot generated 2 new + 701 unchanged - 2 fixed = 703 total (was 703)
+1 💚whitespace0m 0sThe patch has no whitespace issues.
+1 💚xml0m 0sThe patch has no ill-formed XML file.
+1 💚hadoopcheck7m 59sPatch does not cause any errors with Hadoop 3.2.4 3.3.4.
+1 💚spotless0m 39spatch has no errors when running spotless:check.
_ Other Tests _
+1 💚asflicense0m 13sThe patch does not generate ASF License warnings.
32m 59s
SubsystemReport/Notes
DockerClientAPI=1.41 ServerAPI=1.41 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4821/1/artifact/yetus-general-check/output/Dockerfile
GITHUB PR#4821
Optional Testsdupname asflicense javac hadoopcheck spotless xml compile
unameLinux eefa38f0e25f 5.4.0-124-generic #140-Ubuntu SMP Thu Aug 4 02:23:37 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / 8d2efc8
Default JavaTemurin-1.8.0_345-b01
javachttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4821/1/artifact/yetus-general-check/output/diff-compile-javac-root.txt
Max. process+thread count139 (vs. ulimit of 30000)
modulesC: . U: .
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4821/1/console
versionsgit=2.17.1 maven=3.6.3
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache9

Copy link
Copy Markdown
Contributor

2.14.0-rc2 is out, maybe we should wait for 2.14.0 final release and then upgrading? Will need a new thirdparty release then...

@Apache-HBase

Copy link
Copy Markdown

💔 -1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec1m 4sDocker mode activated.
-0 ⚠️yetus0m 4sUnprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+1 💚mvninstall2m 54smaster passed
+1 💚compile1m 54smaster passed
+1 💚shadedjars3m 51sbranch has no errors when building our shaded downstream artifacts.
+1 💚javadoc1m 59smaster passed
_ Patch Compile Tests _
+1 💚mvninstall2m 42sthe patch passed
+1 💚compile2m 6sthe patch passed
+1 💚javac2m 6sthe patch passed
+1 💚shadedjars5m 3spatch has no errors when building our shaded downstream artifacts.
+1 💚javadoc2m 36sthe patch passed
_ Other Tests _
-1 ❌unit328m 51sroot in the patch failed.
355m 31s
SubsystemReport/Notes
DockerClientAPI=1.41 ServerAPI=1.41 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4821/1/artifact/yetus-jdk11-hadoop3-check/output/Dockerfile
GITHUB PR#4821
Optional Testsjavac javadoc unit shadedjars compile
unameLinux d655f6788467 5.4.0-122-generic #138-Ubuntu SMP Wed Jun 22 15:00:31 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / 8d2efc8
Default JavaEclipse Adoptium-11.0.16.1+1
unithttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4821/1/artifact/yetus-jdk11-hadoop3-check/output/patch-unit-root.txt
Test Resultshttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4821/1/testReport/
Max. process+thread count2451 (vs. ulimit of 30000)
modulesC: . U: .
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4821/1/console
versionsgit=2.17.1 maven=3.6.3
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@Apache-HBase

Copy link
Copy Markdown

💔 -1 overall

VoteSubsystemRuntimeComment
+0 🆗reexec1m 32sDocker mode activated.
-0 ⚠️yetus0m 3sUnprocessed flag(s): --brief-report-file --spotbugs-strict-precheck --whitespace-eol-ignore-list --whitespace-tabs-ignore-list --quick-hadoopcheck
_ Prechecks _
_ master Compile Tests _
+1 💚mvninstall3m 54smaster passed
+1 💚compile2m 39smaster passed
+1 💚shadedjars5m 35sbranch has no errors when building our shaded downstream artifacts.
+1 💚javadoc2m 49smaster passed
_ Patch Compile Tests _
+1 💚mvninstall3m 48sthe patch passed
+1 💚compile2m 33sthe patch passed
+1 💚javac2m 33sthe patch passed
+1 💚shadedjars5m 53spatch has no errors when building our shaded downstream artifacts.
+1 💚javadoc2m 41sthe patch passed
_ Other Tests _
-1 ❌unit404m 36sroot in the patch failed.
437m 58s
SubsystemReport/Notes
DockerClientAPI=1.41 ServerAPI=1.41 base: https://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4821/1/artifact/yetus-jdk8-hadoop3-check/output/Dockerfile
GITHUB PR#4821
Optional Testsjavac javadoc unit shadedjars compile
unameLinux 3eec98bdd734 5.4.0-124-generic #140-Ubuntu SMP Thu Aug 4 02:23:37 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build toolmaven
Personalitydev-support/hbase-personality.sh
git revisionmaster / 8d2efc8
Default JavaTemurin-1.8.0_345-b01
unithttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4821/1/artifact/yetus-jdk8-hadoop3-check/output/patch-unit-root.txt
Test Resultshttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4821/1/testReport/
Max. process+thread count2342 (vs. ulimit of 30000)
modulesC: . U: .
Console outputhttps://ci-hbase.apache.org/job/HBase-PreCommit-GitHub-PR/job/PR-4821/1/console
versionsgit=2.17.1 maven=3.6.3
Powered byApache Yetus 0.12.0 https://yetus.apache.org

This message was automatically generated.

@apurtell

Copy link
Copy Markdown
ContributorAuthor

2.14.0-rc2 is out, maybe we should wait for 2.14.0 final release and then upgrading?

Sure we can wait. I'll move this to draft and reschedule the JIRA.

Will need a new thirdparty release then...

You mean because of hbase-shaded-jackson-jaxrs-json-provider I presume. Ok.

@apurtell
apurtell marked this pull request as draft October 11, 2022 17:05
@Apache9

Copy link
Copy Markdown
Contributor

Fixed by #4878

@Apache9Apache9 closed this Nov 20, 2022
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@apurtell@Apache-HBase@Apache9