Skip to content

Commit 6616025

Browse files
roczeiprabhjyotsingh
authored andcommitted
ODP-3237: [SPARK-45590][BUILD] Upgrade okio to 1.17.6 from 1.15.0
This PR aims to upgrade `okio` from 1.15.0 to 1.17.6. Okio 1.15.0 is vulnerable due to CVE-2023-3635, details: https://nvd.nist.gov/vuln/detail/CVE-2023-3635 Previous attempts to fix this security issue: Update okio to version 1.17.6 apache#5587: fabric8io/kubernetes-client#5587 Followup to Update okio to version 1.17.6 apache#5935: fabric8io/kubernetes-client#5935 Unfortunately it is still using 1.15.0: https://github.com/apache/spark/blob/v4.0.0-preview1/dev/deps/spark-deps-hadoop-3-hive-2.3#L227 https://github.com/apache/spark/blob/v3.5.2/dev/deps/spark-deps-hadoop-3-hive-2.3#L210 No. Pass the CIs. No. Closes apache#47758 from roczei/SPARK-45590. Authored-by: Gabor Roczei <roczei@cloudera.com> Signed-off-by: Kent Yao <yao@apache.org> (cherry picked from commit c8cf394)
1 parent 826b869 commit 6616025

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

pom.xml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,7 @@
241241
<!-- org.fusesource.leveldbjni will be used except on arm64 platform. -->
242242
<leveldbjni.group>org.fusesource.leveldbjni</leveldbjni.group>
243243
<kubernetes-client.version>6.13.2</kubernetes-client.version>
244+
<okio.version>1.17.6</okio.version>
244245

245246
<test.java.home>${java.home}</test.java.home>
246247

@@ -2792,6 +2793,11 @@
27922793
<artifactId>arpack</artifactId>
27932794
<version>${netlib.ludovic.dev.version}</version>
27942795
</dependency>
2796+
<dependency>
2797+
<groupId>com.squareup.okio</groupId>
2798+
<artifactId>okio</artifactId>
2799+
<version>${okio.version}</version>
2800+
</dependency>
27952801
</dependencies>
27962802
</dependencyManagement>
27972803

0 commit comments

Comments
 (0)