github-actions[bot] commented on code in PR #67065:
URL: https://github.com/apache/doris/pull/67065#discussion_r3842056885
##########
fe/pom.xml:
##########
@@ -455,7 +455,7 @@ under the License.
<maven-shade-plugin.version>3.6.2</maven-shade-plugin.version>
<argLine></argLine>
<trino.version>435</trino.version>
- <nimbusds.version>10.0.1</nimbusds.version>
+ <nimbusds.version>10.0.2</nimbusds.version>
Review Comment:
[P1] Remove the affected Nimbus copy embedded in Hadoop's runtime jar
This property only governs ordinary Maven dependencies. `fe-core` still
receives `hadoop-client-runtime:3.4.2` through `ranger-plugins-common:2.8.0`,
and the FE runtime assembly ships that jar unchanged. The prebuilt jar embeds
`com.nimbusds:nimbus-jose-jwt:9.37.2` under
`org.apache.hadoop.shaded.com.nimbusds`; the [9.x fixed boundary for
CVE-2025-53864 is 9.37.4](https://github.com/advisories/GHSA-xwmg-2g98-w7v9).
Because those classes are already relocated, the unshaded 10.0.2 dependency
selected here cannot replace them, so affected Nimbus code remains in `fe/lib`
despite the PR's remediation claim. Please exclude or replace the shaded Hadoop
client pair, or update the enclosing Hadoop runtime artifact to one built with
a fixed Nimbus release, then verify the packaged distribution for both
relocated and ordinary Nimbus copies. This is a package-remediation finding; I
did not establish a remotely reachable Doris exploit path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
