Mailing-List: contact dev-help@zookeeper.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@zookeeper.apache.org
MIME-Version: 1.0
In-Reply-To: <1965002853.1340517.1492782512779@mail.yahoo.com>
References: <CACkLabjUTwxM8XNumFCYzS5i-1Z7a6znrF9PP4GgVOG1NPtA3A@mail.gmail.com>
 <CACkLabhZuod=ap6rBEvmnxn4a03_fTGX5oS5omuLG_t=qNSJpg@mail.gmail.com>
 <CACkLabhpfftJd43A6gHAbYR1+Vadh2FF6raOo+Xo+oG7dgsXUg@mail.gmail.com>
 <CACkLabgvX7nb9EYGHqKON588D2heCMw2S2qVEXo4DygHHJ2=8Q@mail.gmail.com> <1965002853.1340517.1492782512779@mail.yahoo.com>
From: Michael Han <hanm@cloudera.com>
Date: Mon, 24 Apr 2017 10:44:29 -0700
Message-ID: <CA+i0x1KPVYwmZqZeq=dXofWykRwLVK=Q-wP0v1oZu3ZH8eX7Yg@mail.gmail.com>
Subject: Re: What is the role of Zookeeper and its external Integration dependencies
To: dev@zookeeper.apache.org
Cc: UserZooKeeper <user@zookeeper.apache.org>, devulapalli8@gmail.com
Content-Type: multipart/alternative; boundary=001a1143f1688e72ba054ded2a25
archived-at: Mon, 24 Apr 2017 17:45:07 -0000

--001a1143f1688e72ba054ded2a25
Content-Type: text/plain; charset=UTF-8

Some notes on the CVE - it's only affecting the C client shell, which is
not part of the C client API. Even if some of the projects mentioned here
use C client API (which afaik does not), they should not be impacted by
this specific CVE from a functional point of view.

On Fri, Apr 21, 2017 at 6:48 AM, Bobby Evans <evans@yahoo-inc.com.invalid>
wrote:

> Upendar,
> You are asking questions about multiple projects on a mailing list only
> for one of them.  Your questions are also a bit confusing which is probably
> why no one has answered them yet.  I understand a bit about ZK, and kafka,
> but I am a storm committer so hopefully I can answer some of your questions.
> 1)  The dependencies for ZK are called out in the pom.xml for the version
> you are using.
>
> https://mvnrepository.com/artifact/org.apache.zookeeper/zookeeper
> For 3.4.10, the version you are asking about https://mvnrepository.com/
> artifact/org.apache.zookeeper/zookeeper/3.4.10 lists several
> dependencies.   The client and the server are together in the same package
> and there are some configuration options here too that control the usage of
> some dependencies.  As such I am not sure exactly which are required just
> for the client and what are just for the server.  I do know that jline is
> just for the client and is not even a 100% requirement there.
>
> 2) The role of ZK in storm is to store the current state of the cluster.
> In the 1.x release and above it also does leader election.  For Kafka the
> role is similar.  It holds the state of the system, although I am not as
> familiar with the internals here.
> As for providing a better use case to understand I am not sure at all what
> you mean.  ZK is a fairly general purpose state store that is used by a lot
> of different projects in different ways.  If you want to see some of what
> is possible look at http://curator.apache.org/ which provides higher
> level APIs on top of ZK to do a lot of different useful things.
> 3) This is where I am not an expert.  The CVE you mentioned appears to be
> for a buffer overflow in the C API.  I know storm only uses the java API so
> it should not be an issue for you.  I am not sure about kafka, but I
> suspect that it too does not use the C API.  You might want to check on the
> kafka mailing list though.
> If you just want to upgrade to 3.4.10, you probably can on the server
> side.  I believe that all of the 3.4.x clients should be compatible with
> all of the 3.4.x servers, but you probably want to test it out first to be
> sure it all appears to be working.  As for upgrading the clients that is
> something you need to work with both storm and kafka to do.   For storm I
> am not totally sure on 0.10 if zookeeper is shaded or not.  I don't think
> it is so you can probably just replace the zookeeper jar in the lib
> directory on all of the nodes with the new one.  But I don't know for sure.
>
> - Bobby
>
> On Thursday, April 20, 2017, 9:02:51 PM CDT, upendar devu <
> devulapalli8@gmail.com> wrote:Could you please respond to my query. Thanks
>
> On Thu, Apr 13, 2017 at 2:46 PM, upendar devu <devulapalli8@gmail.com>
> wrote:
>
> > Sorry looks like I missed to share my queries to dev team
> >
> > We are using zookeeper 3.4.6 version with integration of Apache Kafka ,
> > Apache Storm and Zookeeper.
> >
> > I would like to understand the following things. Please help me to
> clarify.
> >
> > 1. What are Integration dependencies of Zookeeper ?
> >    Since we are using Kafka, Storm , so we need Zookeeper ? which
> external
> > integration has dependencies
> >
> > 2. What is the actual role of zookeeper with the integration of Apache
> > Kafka,Apache Storm.  Could you please provide a better use case to
> > understand. sorry asking this question, I need to understand and am aware
> > of this at least now from you.
> >
> > 3. We are planning to upgrade Zookeeper version to 3.4.10 due to CVE (
> > CVE-2016-5017) mentioned with version 3.4.6 ;  Do we also need to upgrade
> > depedency integration components like Apache Storm(*using 0.10.0*) and
> > Apache Kafka (Using *0.8.1.1*) ? which version those should be upgraded
> > to  ?
> >
> > On Thu, Apr 13, 2017 at 2:43 PM, upendar devu <devulapalli8@gmail.com>
> > wrote:
> >
> >> Including Dev Team to address my queries
> >>
> >> On Thu, Apr 13, 2017 at 2:39 PM, upendar devu <devulapalli8@gmail.com>
> >> wrote:
> >>
> >>> We are using zookeeper 3.4.6 version with integration of Apache Kafka ,
> >>> Apache Storm and Zookeeper.
> >>>
> >>> I would like to understand the following things. Please help me to
> >>> clarify.
> >>>
> >>> 1. What are Integration dependencies of Zookeeper ?
> >>>    Since we are using Kafka, Storm , so we need Zookeeper ? which
> >>> external integration has dependencies
> >>>
> >>> 2. What is the actual role of zookeeper with the integration of Apache
> >>> Kafka,Apache Storm.  Could you please provide a better use case to
> >>> understand.
> >>>
> >>> 3. We are planning to upgrade Zookeeper version to 3.4.10 due to CVE (
> >>> CVE-2016-5017) mentioned with version 3.4.6 ;  Do we also need to
> >>> upgrade depedency integration components like Apache Storm(*using
> >>> 0.10.0*) and Apache Kafka (Using *0.8.1.1*) ? which version those
> >>> should be upgraded to  ?
> >>>
> >>>
> >>> Thanks
> >>> Upendar
> >>>
> >>
> >>
> >
>


-- 
Cheers
Michael.

--001a1143f1688e72ba054ded2a25--