-
Notifications
You must be signed in to change notification settings - Fork 3.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
HBASE-25568 Upgrade Thrift jar to fix CVE-2020-13949 #2958
Conversation
💔 -1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
Couldn't find the libthrift 0.14.0 jar in Apache maven repo... [ERROR] Failed to execute goal on project hbase-thrift: Could not resolve dependencies for project org.apache.hbase:hbase-thrift:jar:3.0.0-SNAPSHOT: Failure to find org.apache.thrift:libthrift:jar:0.14.0 in https://repo.maven.apache.org/maven2 was cached in the local repository, resolution will not be reattempted until the update interval of central has elapsed or updates are forced -> [Help 1] @saintstack Sir, how new jars are uploaded in Apache maven repo? |
search.maven.org shows latest version as 0.13.0. Apache repos also are in the same state: https://repository.apache.org/content/groups/public/org/apache/thrift/libthrift/ and https://repository.apache.org/content/repositories/releases/org/apache/thrift/libthrift/ The Thrift project hasn't completed the release of 0.14.0, we can't take a dependency on it until that happens. |
💔 -1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
🎊 +1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
🎊 +1 overall
This message was automatically generated. |
hbase-examples/src/main/java/org/apache/hadoop/hbase/thrift2/DemoClient.java
Outdated
Show resolved
Hide resolved
hbase-thrift/src/main/java/org/apache/hadoop/hbase/thrift2/client/ThriftConnection.java
Show resolved
Hide resolved
💔 -1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
🎊 +1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
Recently thrift 0.14.1 released due to some bug fixed, will update the PR with thrift 0.14.1 version. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. There's a CVE in 0.13.x, this is a much needed adition!
💔 -1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
🎊 +1 overall
This message was automatically generated. |
💔 -1 overall
This message was automatically generated. |
Upgrade the libthrift version to 0.14.0