-
Notifications
You must be signed in to change notification settings - Fork 9.1k
HADOOP-18655. Upgrade kerby to 2.0.3 due to CVE-2023-25613 #5458
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
💔 -1 overall
This message was automatically generated. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
+1
merged to trunk. thanks! @rohit-kb can you do a pr with this patch cherrypicked into branch-3.3? that'll get into people's hands faster. we are doing a 3.3.5 RC this week, but I am reluctant to do a last minute change here. How exposed do you think hadoop apps are exposed to this? |
Thanks @steveloughran for the review and the update. Since there is no reference to LdapIdentityBackend, so I assume we are not porting it to branch-3.3 then? In which case, I will mark the jira as resolved. |
do a pr for 3.3 anyway, to stop people seeing warnings in audits of depenencies. it is not needed in the 3.3.5 release |
Upgrade kerby to 2.0.3 due to the CVE https://nvd.nist.gov/vuln/detail/CVE-2023-25613 Contributed by Rohit Kumar Badeau
apache#5458) Upgrade kerby to 2.0.3 due to the CVE https://nvd.nist.gov/vuln/detail/CVE-2023-25613 Contributed by Rohit Kumar Badeau (cherry-picked from 487368c) Change-Id: I92655865e69d27299856e9dedfcfc28d432a65b7
Upgrade kerby to 2.0.3 due to the CVE https://nvd.nist.gov/vuln/detail/CVE-2023-25613 Contributed by Rohit Kumar Badeau
Description of PR
Upgrading kerby to 2.0.3 due to the CVE https://nvd.nist.gov/vuln/detail/CVE-2023-25613
For code changes:
LICENSE
,LICENSE-binary
,NOTICE-binary
files?