docker build: datashield/molgenis-armadillo:test has critical CVE

[erikzwart]

The Docker image build here: datashield/molgenis-armadillo:test has a critical cve identified by docker scout:

(Stuart) Traced back the serious complaint to org.apache.hadoop packages hadoop-client via jar

In molgenis-service-armadillo/armadillo/build.gradle it appears

     implementation 'org.apache.parquet:parquet-hadoop:1.13.1'
     implementation 'org.apache.hadoop:hadoop-client:3.3.6'

molgenis-service-armadillo/armadillo/build.gradle

Line 56 in 2fb6825

implementation 'org.apache.parquet:parquet-hadoop:1.13.1'

[marikaris]

@StuartWheater Do you have a description of the CVE anywhere? I can't find it by just googling it. I would like to read into it to see if it actually affects the way we use it and if so see if they're planning on fixing it soon, as we are using the last version of this library. And whether previous versions of the library have the same issue.

[erikzwart]

CVE-2023-25613