Uploaded image for project: 'HBase'
  1. HBase
  2. HBASE-25755

Exclude tomcat-embed-core from libthrift

    XMLWordPrintableJSON

Details

    Description

      HBASE-25568 upgraded the Thrift dependency to 0.14.1 to fix a known CVE but a dependency issue in libthrift brings in tomcat-embed-core which has many vulnerabilities. See: THRIFT-5375
      Since this dependency is used in Thrift only for a test we can safely exclude it inside HBase.

      Attachments

        Issue Links

          is related to

          Bug - A problem which impairs or prevents the functions of the product. HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949

          • Critical - Crashes, loss of data, severe memory leak.
          • Resolved
          links to

          Web Link GitHub Pull Request #3141

          Activity

            People

              psomogyi Peter Somogyi
              psomogyi Peter Somogyi
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: