From issues-return-191649-archive-asf-public=cust-asf.ponee.io@hive.apache.org Mon Jun 1 07:10:04 2020 Return-Path: X-Original-To: archive-asf-public@cust-asf.ponee.io Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [207.244.88.153]) by mx-eu-01.ponee.io (Postfix) with SMTP id A11BE18066C for ; Mon, 1 Jun 2020 09:10:03 +0200 (CEST) Received: (qmail 10161 invoked by uid 500); 1 Jun 2020 07:10:03 -0000 Mailing-List: contact issues-help@hive.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@hive.apache.org Delivered-To: mailing list issues@hive.apache.org Received: (qmail 10094 invoked by uid 99); 1 Jun 2020 07:10:02 -0000 Received: from mailrelay1-us-west.apache.org (HELO mailrelay1-us-west.apache.org) (209.188.14.139) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 01 Jun 2020 07:10:02 +0000 Received: from jira-he-de.apache.org (static.172.67.40.188.clients.your-server.de [188.40.67.172]) by mailrelay1-us-west.apache.org (ASF Mail Server at mailrelay1-us-west.apache.org) with ESMTP id 7D283E2D90 for ; Mon, 1 Jun 2020 07:10:02 +0000 (UTC) Received: from jira-he-de.apache.org (localhost.localdomain [127.0.0.1]) by jira-he-de.apache.org (ASF Mail Server at jira-he-de.apache.org) with ESMTP id 782907822BA for ; Mon, 1 Jun 2020 07:10:00 +0000 (UTC) Date: Mon, 1 Jun 2020 07:10:00 +0000 (UTC) From: "ASF GitHub Bot (Jira)" To: issues@hive.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Work logged] (HIVE-21173) Upgrade Apache Thrift to 0.9.3-1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/HIVE-21173?focusedWorklogId=3D= 439387&page=3Dcom.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpa= nel#worklog-439387 ] ASF GitHub Bot logged work on HIVE-21173: ----------------------------------------- Author: ASF GitHub Bot Created on: 01/Jun/20 07:09 Start Date: 01/Jun/20 07:09 Worklog Time Spent: 10m=20 Work Description: dlavati commented on pull request #730: URL: https://github.com/apache/hive/pull/730#issuecomment-636655154 Merged in e1090a8aeb52a9e114f7053b77b4cfdec2329490 a while ago. See HIVE= -21000 for any updates on newer versions. ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: users@infra.apache.org Issue Time Tracking ------------------- Worklog Id: (was: 439387) Time Spent: 1h (was: 50m) > Upgrade Apache Thrift to 0.9.3-1 > -------------------------------- > > Key: HIVE-21173 > URL: https://issues.apache.org/jira/browse/HIVE-21173 > Project: Hive > Issue Type: Bug > Components: Thrift API > Reporter: James E. King III > Assignee: David Lavati > Priority: Major > Labels: pull-request-available > Fix For: 4.0.0 > > Attachments: HIVE-21173.01.patch > > Time Spent: 1h > Remaining Estimate: 0h > > The project currently depends on libthrift-0.9.3, however thrift released= 0.12.0 on 2019-JAN-04. This release includes a security fix for THRIFT-450= 6 (CVE-2018-1320). Updating thrift to the latest version will remove that v= ulnerability. > Also note the Apache Thrift project does not publish "libfb303" any longe= r. fb303 is contributed code (in '/contrib') and it has not been maintained= . > =C2=A0 > Ps.: 0.9.3.1 also addresses the CVE, see THRIFT-4506 -- This message was sent by Atlassian Jira (v8.3.4#803005)