Vulnerabilities in Apache Commons IO 2.5 used by Hadoop in Jet

hazelcast / hazelcast-jet

Distributed Stream and Batch Processing

https://jet-start.sh

Other

1.1k stars 205 forks source link

Open olukas opened 3 years ago

olukas commented 3 years ago

Jet uses org.apache.hadoop:hadoop-client which uses commons-io:commons-io in version 2.5 which includes following vulnerability:

CVE-2021-29425 - https://nvd.nist.gov/vuln/detail/CVE-2021-29425 (it should be fixed in version 2.7 - however is seems to currently be in UNDERGOING REANALYSIS state in that version)