HADOOP-19578: Upgrade esdk-obs-java to resolve CVE-2023-3635 #7707
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
💔 -1 overall
This message was automatically generated. |
slfan1989
reviewed
May 26, 2025
| @@ -29,7 +29,7 @@ | |||
| <properties> | |||
| <file.encoding>UTF-8</file.encoding> | |||
| <downloadSources>true</downloadSources> | |||
| <esdk.version>3.20.4.2</esdk.version> | |||
| <esdk.version>3.25.4</esdk.version> | |||
There was a problem hiding this comment.
[ERROR] Dependency convergence error for com.squareup.okio:okio:jar:3.6.0 paths to dependency are:
[ERROR] +-org.apache.hadoop:hadoop-huaweicloud:jar:3.5.0-SNAPSHOT
[ERROR] +-com.huaweicloud:esdk-obs-java:jar:3.25.4:compile
[ERROR] +-com.squareup.okhttp3:okhttp:jar:4.12.0:compile
[ERROR] +-com.squareup.okio:okio:jar:3.6.0:compile
[ERROR] and
[ERROR] +-org.apache.hadoop:hadoop-huaweicloud:jar:3.5.0-SNAPSHOT
[ERROR] +-com.huaweicloud:esdk-obs-java:jar:3.25.4:compile
[ERROR] +-com.squareup.okio:okio:jar:3.8.0:compile
We need to resolve this compilation error.
There was a problem hiding this comment.
@slfan1989 this is an internal dependency "issue" with the esdk-obj-java library -
It uses OkHttp 4.12.0 which declares OkIo 3.6.0,
But it also uses OkIo 3.8.0 directly, overriding OkHttp's version of choice.
If this discrepancy is contained within a single (and external) part of the dependency tree, can this warning be suppressed?
There was a problem hiding this comment.
the pom dependency declarations will need to explicitly exclude the 3.6 versoin; look for the many other uses of to see this in use
YanivKunda
force-pushed
the
HADOOP-19578_upgrade_esdk-obs-java
branch
from
c3f593b to
c4c7bfa
Compare
YanivKunda
force-pushed
the
HADOOP-19578_upgrade_esdk-obs-java
branch
from
c4c7bfa to
1027e19
Compare
|
💔 -1 overall
This message was automatically generated. |
YanivKunda
force-pushed
the
HADOOP-19578_upgrade_esdk-obs-java
branch
from
1027e19 to
e556bde
Compare
|
🎊 +1 overall
This message was automatically generated. |
|
@steveloughran I've used dependencyManagement instead of exclusion - |
There was a problem hiding this comment.
comments; do those and we can merge.
@YanivKunda if you can get this done ASAP we can target 3.4.2
hadoop-tools/hadoop-aws/src/test/java/org/apache/hadoop/fs/s3a/ITestS3AFSMainOperations.java
Outdated
Show resolved
Hide resolved
...azure/src/test/java/org/apache/hadoop/fs/azurebfs/ITestAzureBlobFileSystemMainOperation.java
Outdated
Show resolved
Hide resolved
YanivKunda
force-pushed
the
HADOOP-19578_upgrade_esdk-obs-java
branch
from
e556bde to
1bb0d6c
Compare
YanivKunda
force-pushed
the
HADOOP-19578_upgrade_esdk-obs-java
branch
from
1bb0d6c to
9561b9f
Compare
|
💔 -1 overall
This message was automatically generated. |
|
💔 -1 overall
This message was automatically generated. |
steveloughran
approved these changes
Jul 22, 2025
There was a problem hiding this comment.
did a build and maven dependencies on hadoop-cloud module,
all looks good
[INFO] +- org.apache.hadoop:hadoop-huaweicloud:jar:3.5.0-SNAPSHOT:compile
[INFO] | \- com.huaweicloud:esdk-obs-java:jar:3.25.5:compile
[INFO] | +- com.squareup.okhttp3:okhttp:jar:4.12.0:compile
[INFO] | | \- org.jetbrains.kotlin:kotlin-stdlib-jdk8:jar:1.9.21:compile
[INFO] | | +- org.jetbrains.kotlin:kotlin-stdlib:jar:1.9.21:compile
[INFO] | | | \- org.jetbrains:annotations:jar:13.0:compile
[INFO] | | \- org.jetbrains.kotlin:kotlin-stdlib-jdk7:jar:1.9.21:compile
[INFO] | \- com.squareup.okio:okio:jar:3.8.0:compile
[INFO] | \- com.squareup.okio:okio-jvm:jar:3.8.0:compile
[INFO] \- org.apache.hadoop:hadoop-tos:jar:3.5.0-SNAPSHOT:compile
now, does esdk-obs-java get bundled in our binary releases? I don't see that being the case, so there's no need to updatee LICENSE-binary.
@YanivKunda you've retested this, yes? If so check the box on the PR definition above (I restored it...), and say which service endpoint you ran the integration tests against
+1 pending this test result
|
@steveloughran I verified the distribution doesn't contain this jar (interestingly, it does contain the Aliyun SDK jars). |
|
@steveloughran I see the original code was contributed by a "zhongjun" 5 years ago, |
|
well, we don't distribute it, but unless anybody is set up to test it, we have to choose between "used to work but has cve" and "more secure but may not work" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of PR
Upgrade esdk-obs-java (in hadoop-huaweicloud) to resolve CVE-2023-3635
How was this patch tested?
Ran existing tests.
For code changes:
LICENSE,LICENSE-binary,NOTICE-binaryfiles?