Uploaded image for project: 'Apache Ozone'
  1. Apache Ozone
  2. HDDS-10600

Bump nimbus-jose-jwt version

    XMLWordPrintableJSON

Details

    • Task
    • Status: Resolved
    • Major
    • Resolution: Done
    • 1.5.0
    • 1.5.0, 1.4.1
    • None

    Description

      It's a continuation of the investigation made in HDDS-10589
      hdds-hadoop-dependency-(client|server) modules depend on hadoop-common, the latter depends on com.nimbusds:nimbus-jose-jwt:9.8.1 (through org.apache.hadoop:hadoop-auth).

      The 9.8.1th version of the com.nimbusds:nimbus-jose-jwt library contains a shaded version of the net.minidev:json-smart:1.3.2 (https://bitbucket.org/connect2id/nimbus-jose-jwt/src/815b98228df7be7b918ae368ea003a034768f769/pom.xml#lines-59) that has a CVE - https://nvd.nist.gov/vuln/detail/CVE-2021-31684.

      The nearest version of the nimbus-jose-jwt that doesn't have the CVE is 9.24 - there the json-smart library was replaced with com.google.code.gson:gson.
      Hence, we need to exclude nimbus-jose-jwt dependency from the hadoop-common transitive dependencies list in hdds-hadoop-dependency-(client|server) modules and include it directly with the certain version (9.24)

      Attachments

        Issue Links

          Activity

            People

              vtutrinov Vyacheslav Tutrinov
              vtutrinov Vyacheslav Tutrinov
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: