HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853 by hotcodemacha · Pull Request #4991 · apache/hadoop

hotcodemacha · 2022-10-09T17:34:14Z

Description of PR

Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853

For code changes:

Does the title or this PR starts with the corresponding JIRA issue id (e.g. 'HADOOP-17799. Your PR title ...')?
Object storage: have the integration tests been executed and the endpoint declared according to the connector-specific documentation?
If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under ASF 2.0?
If applicable, have you updated the LICENSE, LICENSE-binary, NOTICE-binary files?

hotcodemacha · 2022-10-09T17:47:53Z

@pjfanning - 2.7.1 doesnt seem to be there yet. Can you confirm once? Thanks.

pjfanning · 2022-10-09T17:56:51Z

@ashutoshcipher looks like you are right - Github seems to have made this issue public before hsqldb have managed to publish the release to Maven Central.

Maybe, if we wait for a few days and check https://repo1.maven.org/maven2/org/hsqldb/hsqldb/ again.

hotcodemacha · 2022-10-09T18:00:56Z

Yeah, I will keep the PR open and keep a check on mvn.

slfan1989 · 2022-10-09T21:58:45Z

@ashutoshcipher @pjfanning we may not be able to upgrade to 2.7.0, I tried to upgrade to 2.6.0 some time ago, but found that 2.6.0 and above require JDK 11, do we have a solution for this?

hotcodemacha · 2022-10-09T22:05:31Z

Thanks @slfan1989. I can see here - http://hsqldb.org./ for Version 2.7.0 that

Individual jars for Java 6, 8 and 11 are available

pjfanning · 2022-10-09T22:08:17Z

It seems that you can download jdk8 friendly jars from

I'm not a maven expert but I think you might be able to specify a 'classifier' - in this case, possibly 'jdk8' in order to have maven download hsqldb-2.7.0-jdk8.jar.

Presumably v2.7.1.jar will be similar (whenever it gets published).

hadoop-yetus · 2022-10-10T06:44:38Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 57s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 1s		codespell was not available.
+0 🆗	detsecrets	0m 1s		detect-secrets was not available.
+0 🆗	xmllint	0m 1s		xmllint was not available.
+0 🆗	shelldocs	0m 1s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	15m 24s		Maven dependency ordering for branch
+1 💚	mvninstall	25m 55s		trunk passed
+1 💚	compile	23m 18s		trunk passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	compile	20m 55s		trunk passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	mvnsite	19m 17s		trunk passed
+1 💚	javadoc	8m 12s		trunk passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javadoc	7m 26s		trunk passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	shadedclient	35m 23s		branch has no errors when building and testing our client artifacts.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 24s		Maven dependency ordering for patch
-1 ❌	mvninstall	5m 17s	/patch-mvninstall-root.txt	root in the patch failed.
-1 ❌	compile	9m 5s	/patch-compile-root-jdkUbuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04.txt	root in the patch failed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04.
-1 ❌	javac	9m 5s	/patch-compile-root-jdkUbuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04.txt	root in the patch failed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04.
-1 ❌	compile	8m 8s	/patch-compile-root-jdkPrivateBuild-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07.txt	root in the patch failed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07.
-1 ❌	javac	8m 8s	/patch-compile-root-jdkPrivateBuild-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07.txt	root in the patch failed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07.
+1 💚	blanks	0m 0s		The patch has no blanks issues.
-1 ❌	mvnsite	2m 46s	/patch-mvnsite-root.txt	root in the patch failed.
+1 💚	shellcheck	0m 0s		No new issues.
-1 ❌	javadoc	3m 13s	/patch-javadoc-root-jdkUbuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04.txt	root in the patch failed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04.
-1 ❌	javadoc	3m 2s	/patch-javadoc-root-jdkPrivateBuild-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07.txt	root in the patch failed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07.
-1 ❌	shadedclient	14m 44s		patch has errors when building and testing our client artifacts.
			_ Other Tests _
-1 ❌	unit	602m 51s	/patch-unit-root.txt	root in the patch failed.
+1 💚	asflicense	1m 37s		The patch does not generate ASF License warnings.
		789m 5s

Reason	Tests
Failed junit tests	hadoop.hdfs.server.namenode.ha.TestSeveralNameNodes
	hadoop.hdfs.server.diskbalancer.command.TestDiskBalancerCommand

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4991/1/artifact/out/Dockerfile
GITHUB PR	#4991
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint shellcheck shelldocs
uname	Linux deffae4b7a47 4.15.0-191-generic #202-Ubuntu SMP Thu Aug 4 01:49:29 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `2b0d246`
Default Java	Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4991/1/testReport/
Max. process+thread count	2909 (vs. ulimit of 5500)
modules	C: hadoop-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4991/1/console
versions	git=2.25.1 maven=3.6.3 shellcheck=0.7.0
Powered by	Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

pjfanning · 2022-10-10T22:09:12Z

Looks like the hsqldb do not want to do a v2.7.1 release. They want users to set system properties.

https://sourceforge.net/p/hsqldb/discussion/73673/thread/0df9e4f45a/?limit=25#2489

slfan1989 · 2022-10-10T22:45:58Z

@pjfanning Thank you very much for your feedback. From a personal point of view, we should still wait for v2.7.1. The way of setting properties does not seem to be very good. If we hard-code it, we may need to remove it later.

pjfanning · 2022-10-10T22:48:19Z

@pjfanning Thank you very much for your feedback. From a personal point of view, we should still wait for v2.7.1. The way of setting properties does not seem to be very good. If we hard-code it, we may need to remove it later.

Yes, it's quite messy all in all. I'm not sure why they won't do a release.

hotcodemacha · 2022-10-10T22:52:03Z

Thanks @pjfanning @slfan1989 . I think we can wait for a while for 2.7.1 release and take a call if we want to make changes in code or not

slfan1989 · 2022-10-11T00:20:09Z

Yes, it's quite messy all in all. I'm not sure why they won't do a release.

let's wait more time.

adoroszlai · 2022-10-31T07:29:39Z

@ashutoshcipher @pjfanning Version 2.7.1 is now available. May I ask you to update the PR?

you might be able to specify a 'classifier' - in this case, possibly 'jdk8' in order to have maven download hsqldb-2.7.0-jdk8.jar.

Yes, <classifier>jdk8</classifier> is needed for hsqldb dependency in all affected POMs.

hotcodemacha · 2022-10-31T07:42:26Z

@ashutoshcipher @pjfanning Version 2.7.1 is now available. May I ask you to update the PR?

you might be able to specify a 'classifier' - in this case, possibly 'jdk8' in order to have maven download hsqldb-2.7.0-jdk8.jar.

Yes, <classifier>jdk8</classifier> is needed for hsqldb dependency in all affected POMs.

Thanks @adoroszlai. Triggering jenkins once again for cleaner build

adoroszlai

Thanks @ashutoshcipher for updating the patch.

We'll need the following additional change to use the jdk8 artifacts:

     <dependency>
       <groupId>org.hsqldb</groupId>
       <artifactId>hsqldb</artifactId>
+      <classifier>jdk8</classifier>

in:

hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-jobclient/pom.xml
hadoop-mapreduce-project/hadoop-mapreduce-examples/pom.xml
hadoop-mapreduce-project/pom.xml
hadoop-project/pom.xml
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-common/pom.xml

to avoid:

09:24:56,115 [ERROR]   bad class file: ~/.m2/repository/org/hsqldb/hsqldb/2.7.1/hsqldb-2.7.1.jar(org/hsqldb/server/Server.class)
09:24:56,116 [ERROR]     class file has wrong version 55.0, should be 52.0

when building with Java 8.

hotcodemacha · 2022-10-31T08:28:06Z

Thanks @adoroszlai. I am resolving and updating exactly the same in my local :)

adoroszlai

Thanks @ashutoshcipher for the patch.

hotcodemacha · 2022-10-31T23:58:02Z

Thanks @ashutoshcipher for the patch.

Thank you so much @adoroszlai for reviewing and your comments.

hadoop-yetus · 2022-11-01T03:55:36Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	1m 47s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 1s		codespell was not available.
+0 🆗	detsecrets	0m 1s		detect-secrets was not available.
+0 🆗	xmllint	0m 1s		xmllint was not available.
+0 🆗	shelldocs	0m 1s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	16m 3s		Maven dependency ordering for branch
+1 💚	mvninstall	26m 13s		trunk passed
+1 💚	compile	24m 8s		trunk passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	compile	22m 11s		trunk passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	mvnsite	21m 38s		trunk passed
+1 💚	javadoc	9m 14s		trunk passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javadoc	8m 26s		trunk passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	shadedclient	38m 37s		branch has no errors when building and testing our client artifacts.
-0 ⚠️	patch	39m 2s		Used diff version of patch file. Binary files and potentially other changes not applied. Please rebase and squash commits if necessary.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 31s		Maven dependency ordering for patch
-1 ❌	mvninstall	10m 0s	/patch-mvninstall-root.txt	root in the patch failed.
+1 💚	compile	24m 42s		the patch passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javac	24m 42s		the patch passed
-1 ❌	compile	11m 56s	/patch-compile-root-jdkPrivateBuild-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07.txt	root in the patch failed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07.
-1 ❌	javac	11m 56s	/patch-compile-root-jdkPrivateBuild-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07.txt	root in the patch failed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07.
+1 💚	blanks	0m 0s		The patch has no blanks issues.
-1 ❌	mvnsite	14m 40s	/patch-mvnsite-root.txt	root in the patch failed.
+1 💚	shellcheck	0m 0s		No new issues.
+1 💚	javadoc	8m 31s		the patch passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
-1 ❌	javadoc	6m 18s	/patch-javadoc-root-jdkPrivateBuild-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07.txt	root in the patch failed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07.
-1 ❌	shadedclient	27m 35s		patch has errors when building and testing our client artifacts.
			_ Other Tests _
-1 ❌	unit	959m 42s	/patch-unit-root.txt	root in the patch failed.
+1 💚	asflicense	1m 48s		The patch does not generate ASF License warnings.
		1205m 3s

Reason	Tests
Failed junit tests	hadoop.hdfs.server.namenode.ha.TestSeveralNameNodes
	hadoop.hdfs.server.blockmanagement.TestBlockTokenWithShortCircuitRead
	hadoop.hdfs.server.diskbalancer.command.TestDiskBalancerCommand
	hadoop.yarn.server.federation.store.sql.TestFederationSQLServerScriptAccuracy
	hadoop.yarn.server.federation.store.impl.TestSQLFederationStateStore
	hadoop.yarn.server.federation.store.sql.TestFederationMySQLScriptAccuracy

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4991/3/artifact/out/Dockerfile
GITHUB PR	#4991
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint shellcheck shelldocs
uname	Linux 0c4e20aa2853 4.15.0-191-generic #202-Ubuntu SMP Thu Aug 4 01:49:29 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `7f8ec22`
Default Java	Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4991/3/testReport/
Max. process+thread count	2774 (vs. ulimit of 5500)
modules	C: hadoop-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4991/3/console
versions	git=2.25.1 maven=3.6.3 shellcheck=0.7.0
Powered by	Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

hadoop-yetus · 2022-11-01T06:50:14Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 58s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 1s		codespell was not available.
+0 🆗	detsecrets	0m 1s		detect-secrets was not available.
+0 🆗	xmllint	0m 1s		xmllint was not available.
+0 🆗	shelldocs	0m 1s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	15m 49s		Maven dependency ordering for branch
+1 💚	mvninstall	28m 35s		trunk passed
+1 💚	compile	25m 43s		trunk passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	compile	22m 14s		trunk passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	mvnsite	21m 23s		trunk passed
+1 💚	javadoc	10m 12s		trunk passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javadoc	8m 26s		trunk passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	shadedclient	41m 49s		branch has no errors when building and testing our client artifacts.
-0 ⚠️	patch	42m 11s		Used diff version of patch file. Binary files and potentially other changes not applied. Please rebase and squash commits if necessary.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 27s		Maven dependency ordering for patch
+1 💚	mvninstall	28m 39s		the patch passed
+1 💚	compile	24m 56s		the patch passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javac	24m 56s		the patch passed
+1 💚	compile	22m 10s		the patch passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	javac	22m 10s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	mvnsite	20m 16s		the patch passed
+1 💚	shellcheck	0m 0s		No new issues.
+1 💚	javadoc	8m 20s		the patch passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javadoc	7m 32s		the patch passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	shadedclient	40m 22s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
-1 ❌	unit	1033m 24s	/patch-unit-root.txt	root in the patch passed.
+1 💚	asflicense	1m 58s		The patch does not generate ASF License warnings.
		1331m 30s

Reason	Tests
Failed junit tests	hadoop.hdfs.server.namenode.ha.TestObserverNode

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4991/5/artifact/out/Dockerfile
GITHUB PR	#4991
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint shellcheck shelldocs
uname	Linux 3cf6c144939e 4.15.0-191-generic #202-Ubuntu SMP Thu Aug 4 01:49:29 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `4760a4d`
Default Java	Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4991/5/testReport/
Max. process+thread count	3960 (vs. ulimit of 5500)
modules	C: hadoop-project hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-common hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-jobclient hadoop-mapreduce-project/hadoop-mapreduce-examples hadoop-mapreduce-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4991/5/console
versions	git=2.25.1 maven=3.6.3 shellcheck=0.7.0
Powered by	Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

hotcodemacha · 2022-11-01T11:01:17Z

hadoop.hdfs.server.namenode.ha.TestObserverNode failure is unrelated. This UT is failing in many PRs as well.

JIRA for ref - https://issues.apache.org/jira/browse/HDFS-16801

cc: @adoroszlai

hadoop-yetus · 2022-11-02T03:58:32Z

💔 -1 overall

Vote	Subsystem	Runtime	Logfile	Comment
+0 🆗	reexec	0m 56s		Docker mode activated.
			_ Prechecks _
+1 💚	dupname	0m 0s		No case conflicting files found.
+0 🆗	codespell	0m 1s		codespell was not available.
+0 🆗	detsecrets	0m 1s		detect-secrets was not available.
+0 🆗	xmllint	0m 1s		xmllint was not available.
+0 🆗	shelldocs	0m 1s		Shelldocs was not available.
+1 💚	@author	0m 0s		The patch does not contain any @author tags.
-1 ❌	test4tests	0m 0s		The patch doesn't appear to include any new or modified tests. Please justify why no new tests are needed for this patch. Also please list what manual steps were performed to verify this patch.
			_ trunk Compile Tests _
+0 🆗	mvndep	15m 41s		Maven dependency ordering for branch
+1 💚	mvninstall	29m 33s		trunk passed
+1 💚	compile	27m 17s		trunk passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	compile	22m 12s		trunk passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	mvnsite	20m 23s		trunk passed
+1 💚	javadoc	8m 37s		trunk passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javadoc	7m 32s		trunk passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	shadedclient	38m 51s		branch has no errors when building and testing our client artifacts.
-0 ⚠️	patch	39m 13s		Used diff version of patch file. Binary files and potentially other changes not applied. Please rebase and squash commits if necessary.
			_ Patch Compile Tests _
+0 🆗	mvndep	0m 29s		Maven dependency ordering for patch
+1 💚	mvninstall	28m 34s		the patch passed
+1 💚	compile	24m 57s		the patch passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javac	24m 57s		the patch passed
+1 💚	compile	23m 34s		the patch passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	javac	23m 34s		the patch passed
+1 💚	blanks	0m 0s		The patch has no blanks issues.
+1 💚	mvnsite	22m 22s		the patch passed
+1 💚	shellcheck	0m 0s		No new issues.
+1 💚	javadoc	8m 40s		the patch passed with JDK Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04
+1 💚	javadoc	7m 30s		the patch passed with JDK Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
+1 💚	shadedclient	40m 16s		patch has no errors when building and testing our client artifacts.
			_ Other Tests _
+1 💚	unit	976m 44s		root in the patch passed.
+1 💚	asflicense	2m 7s		The patch does not generate ASF License warnings.
		1276m 49s

Subsystem	Report/Notes
Docker	ClientAPI=1.41 ServerAPI=1.41 base: https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4991/6/artifact/out/Dockerfile
GITHUB PR	#4991
Optional Tests	dupname asflicense compile javac javadoc mvninstall mvnsite unit shadedclient codespell detsecrets xmllint shellcheck shelldocs
uname	Linux ca37993ff5ae 4.15.0-191-generic #202-Ubuntu SMP Thu Aug 4 01:49:29 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
Build tool	maven
Personality	dev-support/bin/hadoop.sh
git revision	trunk / `ac3fb31`
Default Java	Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
Multi-JDK versions	/usr/lib/jvm/java-11-openjdk-amd64:Ubuntu-11.0.16+8-post-Ubuntu-0ubuntu120.04 /usr/lib/jvm/java-8-openjdk-amd64:Private Build-1.8.0_342-8u342-b07-0ubuntu1~20.04-b07
Test Results	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4991/6/testReport/
Max. process+thread count	3860 (vs. ulimit of 5500)
modules	C: hadoop-project hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-common hadoop-mapreduce-project/hadoop-mapreduce-client/hadoop-mapreduce-client-jobclient hadoop-mapreduce-project/hadoop-mapreduce-examples hadoop-mapreduce-project . U: .
Console output	https://ci-hadoop.apache.org/job/hadoop-multibranch/job/PR-4991/6/console
versions	git=2.25.1 maven=3.6.3 shellcheck=0.7.0
Powered by	Apache Yetus 0.14.0 https://yetus.apache.org

This message was automatically generated.

adoroszlai · 2022-11-02T07:40:40Z

The only failing Yetus check is test4tests, as there are no new tests. Existing tests have passed. I have checked out the change and verified the dependency tree locally: it has the new org.hsqldb:hsqldb:jar:jdk8:2.7.1 everywhere, e.g.:

[INFO] org.apache.hadoop:hadoop-mapreduce:pom:3.4.0-SNAPSHOT
[INFO] \- org.hsqldb:hsqldb:jar:jdk8:2.7.1:compile

…ache#4991)

hotcodemacha · 2022-11-02T11:26:34Z

The only failing Yetus check is test4tests, as there are no new tests. Existing tests have passed. I have checked out the change and verified the dependency tree locally: it has the new org.hsqldb:hsqldb:jar:jdk8:2.7.1 everywhere, e.g.:
[INFO] org.apache.hadoop:hadoop-mapreduce:pom:3.4.0-SNAPSHOT
[INFO] \- org.hsqldb:hsqldb:jar:jdk8:2.7.1:compile

Thanks

…ache#4991)

…22-41853 (apache#4991) (cherry-picked from e62ba16) Change-Id: I439ce1c12dfd47637cf74fb472137277e62c3140

…ache#4991)

OSV-16076: HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853 (apache#4991)

HADOOP-18484. Upgrade hsqldb to v2.7.1

2b0d246

hotcodemacha changed the title ~~HADOOP-18484. Upgrade hsqldb to v2.7.1~~ HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853 Oct 9, 2022

hotcodemacha changed the title ~~HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853~~ [DRAFT - DO NOT MERGE] HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853 Oct 9, 2022

Ashutosh Gupta and others added 2 commits October 31, 2022 07:47

Trigger Build

b33427a

Merge branch 'trunk' into HADOOP-18484

7f8ec22

hotcodemacha changed the title ~~[DRAFT - DO NOT MERGE] HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853~~ HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853 Oct 31, 2022

adoroszlai reviewed Oct 31, 2022

View reviewed changes

Comment thread hadoop-project/pom.xml Outdated

Ashutosh Gupta added 2 commits October 31, 2022 08:34

HADOOP-18484. Upgrade hsqldb to v2.7.1

ef85442

Trigger Build

4760a4d

hotcodemacha force-pushed the HADOOP-18484 branch from a1d38ef to 4760a4d Compare October 31, 2022 08:37

adoroszlai approved these changes Oct 31, 2022

View reviewed changes

trigger new CI check

ac3fb31

slfan1989 approved these changes Nov 2, 2022

View reviewed changes

adoroszlai merged commit e62ba16 into apache:trunk Nov 2, 2022

hotcodemacha added a commit to hotcodemacha/hadoop that referenced this pull request Nov 2, 2022

HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853 (ap…

c1a10ff

…ache#4991)

hotcodemacha added a commit to hotcodemacha/hadoop that referenced this pull request Nov 2, 2022

HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853 (ap…

30b3ca9

…ache#4991)

hotcodemacha added a commit to hotcodemacha/hadoop that referenced this pull request Nov 2, 2022

HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853 (ap…

318bccf

…ache#4991)

hotcodemacha added a commit to hotcodemacha/hadoop that referenced this pull request Nov 7, 2022

HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853 (ap…

3d4dc46

…ache#4991)

HarshitGupta11 pushed a commit to HarshitGupta11/hadoop that referenced this pull request Nov 28, 2022

HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853 (ap…

2bd89e6

…ache#4991)

jojochuang pushed a commit to jojochuang/hadoop that referenced this pull request May 23, 2023

CDPD-46788: HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-20…

50088a7

…22-41853 (apache#4991) (cherry-picked from e62ba16) Change-Id: I439ce1c12dfd47637cf74fb472137277e62c3140

prabhjyotsingh pushed a commit to acceldata-io/hadoop that referenced this pull request Apr 13, 2026

HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853 (ap…

1188e9f

…ache#4991)

prabhjyotsingh pushed a commit to acceldata-io/hadoop that referenced this pull request Apr 17, 2026

HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853 (ap…

4e0b4aa

…ache#4991)

prabhjyotsingh added a commit to acceldata-io/hadoop that referenced this pull request Apr 27, 2026

Merge pull request #151 from acceldata-io/OSV-16076

c9ee053

OSV-16076: HADOOP-18484. Upgrade hsqldb to v2.7.1 to mitigate CVE-2022-41853 (apache#4991)

Uh oh!

Conversation

hotcodemacha commented Oct 9, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of PR

For code changes:

Uh oh!

hotcodemacha commented Oct 9, 2022

Uh oh!

pjfanning commented Oct 9, 2022

Uh oh!

hotcodemacha commented Oct 9, 2022

Uh oh!

slfan1989 commented Oct 9, 2022

Uh oh!

hotcodemacha commented Oct 9, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pjfanning commented Oct 9, 2022

Uh oh!

hadoop-yetus commented Oct 10, 2022

Uh oh!

pjfanning commented Oct 10, 2022

Uh oh!

slfan1989 commented Oct 10, 2022

Uh oh!

pjfanning commented Oct 10, 2022

Uh oh!

hotcodemacha commented Oct 10, 2022

Uh oh!

slfan1989 commented Oct 11, 2022

Uh oh!

adoroszlai commented Oct 31, 2022

Uh oh!

hotcodemacha commented Oct 31, 2022

Uh oh!

adoroszlai left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

hotcodemacha commented Oct 31, 2022

Uh oh!

adoroszlai left a comment

Choose a reason for hiding this comment

Uh oh!

hotcodemacha commented Oct 31, 2022

Uh oh!

hadoop-yetus commented Nov 1, 2022

Uh oh!

hadoop-yetus commented Nov 1, 2022

Uh oh!

hotcodemacha commented Nov 1, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hadoop-yetus commented Nov 2, 2022

Uh oh!

adoroszlai commented Nov 2, 2022

Uh oh!

hotcodemacha commented Nov 2, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

hotcodemacha commented Oct 9, 2022 •

edited

Loading

hotcodemacha commented Oct 9, 2022 •

edited

Loading

hotcodemacha commented Nov 1, 2022 •

edited

Loading