Open olukas opened 3 years ago
We already use the latest, as of today, version of Hadoop libraries (3.3.0).
there is no new version of htrace:htrace-core4
which shades a fixed version of Jackson libraries.
NOTE: For Jet 4.5 for some reason OWASP evaluated this vulnerability as dependency:
hazelcast-jet-files-azure-4.5-jar-with-dependencies.jar (shaded: com.fasterxml.jackson.core:jackson-databind:2.4.0)
hazelcast-jet-files-azure-4.5-jar-with-dependencies.jar (shaded: com.fasterxml.jackson.core:jackson-core:2.4.0)
but it seems to be the same dependency just reported in the different way.
So, any updates on this yet?
Jet uses Hadoop which uses
htrace:htrace-core4
in version4.1.0-incubating
which has shadedcom.fasterxml.jackson.core:jackson-databind:2.4.0
which includes following vulnerabilities: