Skip to content

[Snyk] Fix for 52 vulnerabilities #565

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
jdelamar wants to merge 1 commit into
base: branch-3.0
Choose a base branch
from
Open

[Snyk] Fix for 52 vulnerabilities #565

jdelamar wants to merge 1 commit into from

Conversation

@jdelamar
Copy link

@jdelamar jdelamar commented Aug 13, 2025

snyk-top-banner

Snyk has created this PR to fix 52 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

  • pom.xml

Vulnerabilities that will be fixed with an upgrade:

Issue Score Upgrade
critical severity Deserialization of Untrusted Data
SNYK-JAVA-LOG4J-572732		   811   Proof of Concept
high severity SQL Injection
SNYK-JAVA-LOG4J-2342645		   726   Proof of Concept
critical severity Improper Input Validation
SNYK-JAVA-ORGCODEHAUSJACKSON-3326362		   704   org.apache.avro:avro:
1.8.2 -> 1.11.4
org.apache.avro:avro-mapred:
1.8.2 -> 1.11.4
No Known Exploit
high severity Allocation of Resources Without Limits or Throttling
SNYK-JAVA-ORGXERIALSNAPPY-5918282		   696   org.apache.avro:avro:
1.8.2 -> 1.11.4
Proof of Concept
critical severity Deserialization of Untrusted Data
SNYK-JAVA-ORGAPACHEAVRO-8161188		   679   org.apache.avro:avro:
1.8.2 -> 1.11.4
org.apache.avro:avro-mapred:
1.8.2 -> 1.11.4
No Known Exploit
high severity Integer Overflow
SNYK-JAVA-COMGOOGLEPROTOBUF-173761		   654   No Known Exploit
high severity Uncontrolled Recursion
SNYK-JAVA-COMMONSLANG-10734077		   654   org.apache.hive:hive-common:
2.3.7 -> 4.1.0
org.apache.hive:hive-exec:
2.3.7 -> 4.1.0
org.apache.hive:hive-metastore:
2.3.7 -> 3.0.0
org.apache.hive:hive-serde:
2.3.7 -> 2.3.10
org.apache.hive:hive-shims:
2.3.7 -> 2.3.10
Major version upgrade No Known Exploit
medium severity Directory Traversal
SNYK-JAVA-COMMONSIO-1277109		   651   org.apache.hive:hive-exec:
2.3.7 -> 4.1.0
Major version upgrade Mature
medium severity Arbitrary Code Execution
SNYK-JAVA-LOG4J-2316893		   651   Proof of Concept
high severity Stack-based Buffer Overflow
SNYK-JAVA-COMFASTERXMLJACKSONCORE-10500754		   649   No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538		   649   No Known Exploit
high severity Stack-based Buffer Overflow
SNYK-JAVA-COMGOOGLEPROTOBUF-8055227		   649   org.apache.hive:hive-metastore:
2.3.7 -> 3.0.0
Major version upgrade No Known Exploit
high severity Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
SNYK-JAVA-COMMONSBEANUTILS-10259368		   649   No Known Exploit
high severity XML External Entity (XXE) Injection
SNYK-JAVA-COMFASTERXMLJACKSONCORE-1048302		   624   No Known Exploit
high severity Out-of-bounds Read
SNYK-JAVA-IOAIRLIFT-7164637		   624   No Known Exploit
high severity XML External Entity (XXE) Injection
SNYK-JAVA-ORGAPACHEIVY-5847858		   624   org.apache.hive:hive-exec:
2.3.7 -> 4.1.0
Major version upgrade No Known Exploit
high severity Deserialization of Untrusted Data
SNYK-JAVA-LOG4J-2342646		   619   No Known Exploit
high severity Deserialization of Untrusted Data
SNYK-JAVA-LOG4J-2342647		   619   No Known Exploit
high severity Infinite loop
SNYK-JAVA-ORGAPACHECOMMONS-6254296		   619   org.apache.avro:avro:
1.8.2 -> 1.11.4
org.apache.hive:hive-common:
2.3.7 -> 4.1.0
org.apache.hive:hive-exec:
2.3.7 -> 4.1.0
Major version upgrade No Known Exploit
high severity Arbitrary Code Execution
SNYK-JAVA-ORGAPACHEVELOCITY-3116414		   619   org.apache.hive:hive-exec:
2.3.7 -> 4.1.0
Major version upgrade No Known Exploit
high severity Authorization Bypass Through User-Controlled Key
SNYK-JAVA-ORGAPACHEZOOKEEPER-5961102		   619   No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038424		   616   org.apache.hive:hive-common:
2.3.7 -> 4.1.0
Major version upgrade Proof of Concept
medium severity Denial of Service (DoS)
SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038426		   616   org.apache.hive:hive-common:
2.3.7 -> 4.1.0
Major version upgrade Proof of Concept
high severity Denial of Service (DoS)
SNYK-JAVA-COMFASTERXMLJACKSONCORE-2421244		   589   org.apache.hive:hive-common:
2.3.7 -> 4.1.0
Major version upgrade No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-COMGOOGLEPROTOBUF-2331703		   589   No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-COMGOOGLEPROTOBUF-3167772		   589   No Known Exploit
high severity Denial of Service (DoS)
SNYK-JAVA-ORGAPACHECOMMONS-1316641		   589   org.apache.hive:hive-common:
2.3.7 -> 4.1.0
org.apache.hive:hive-exec:
2.3.7 -> 4.1.0
Major version upgrade No Known Exploit
high severity Directory Traversal
SNYK-JAVA-ORGAPACHEIVY-3106929		   589   org.apache.hive:hive-exec:
2.3.7 -> 4.1.0
Major version upgrade No Known Exploit
high severity XML External Entity (XXE) Injection
SNYK-JAVA-ORGCODEHAUSJACKSON-534878		   589   org.apache.avro:avro:
1.8.2 -> 1.11.4
org.apache.avro:avro-mapred:
1.8.2 -> 1.11.4
No Known Exploit
high severity XML Entity Expansion
SNYK-JAVA-ORGGLASSFISHJERSEYMEDIA-595972		   589   No Known Exploit
medium severity Information Exposure
SNYK-JAVA-COMFASTERXMLJACKSONCORE-10332631		   576   Proof of Concept
high severity Timing Attack
SNYK-JAVA-ORGAPACHEHIVE-8663471		   569   org.apache.hive:hive-llap-common:
2.3.7 -> 4.0.0
Major version upgrade No Known Exploit
high severity Directory Traversal
SNYK-JAVA-ORGAPACHEIVY-3106014		   569   org.apache.hive:hive-exec:
2.3.7 -> 4.1.0
Major version upgrade No Known Exploit
medium severity Allocation of Resources Without Limits or Throttling
SNYK-JAVA-COMMONSCONFIGURATION-10116124		   559   No Known Exploit
medium severity Uncontrolled Resource Consumption
SNYK-JAVA-COMMONSIO-8161190		   559   org.apache.hive:hive-exec:
2.3.7 -> 4.1.0
Major version upgrade No Known Exploit
medium severity Creation of Temporary File in Directory with Insecure Permissions
SNYK-JAVA-ORGAPACHEHADOOP-8089372		   554   No Known Exploit
medium severity Incorrect Permission Assignment for Critical Resource
SNYK-JAVA-ORGAPACHEHIVE-8664881		   554   org.apache.hive:hive-exec:
2.3.7 -> 4.1.0
Major version upgrade No Known Exploit
medium severity Cryptographic Issues
SNYK-JAVA-ORGAPACHEDIRECTORYSERVER-1063040		   550   No Known Exploit
medium severity Deserialization of Untrusted Data
SNYK-JAVA-COMGOOGLECODEGSON-1730327		   539   org.apache.hive:hive-exec:
2.3.7 -> 4.1.0
Major version upgrade No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-ORGAPACHECOMMONS-1316638		   539   org.apache.hive:hive-common:
2.3.7 -> 4.1.0
org.apache.hive:hive-exec:
2.3.7 -> 4.1.0
Major version upgrade No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-ORGAPACHECOMMONS-1316639		   539   org.apache.hive:hive-common:
2.3.7 -> 4.1.0
org.apache.hive:hive-exec:
2.3.7 -> 4.1.0
Major version upgrade No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-ORGAPACHECOMMONS-1316640		   539   org.apache.hive:hive-common:
2.3.7 -> 4.1.0
org.apache.hive:hive-exec:
2.3.7 -> 4.1.0
Major version upgrade No Known Exploit
medium severity Information Disclosure
SNYK-JAVA-ORGGLASSFISHJERSEYCORE-1255637		   524   No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-LOG4J-3358774		   509   No Known Exploit
medium severity LDAP Injection
SNYK-JAVA-ORGAPACHEDERBY-6069877		   509   org.apache.derby:derby:
10.12.1.1 -> 10.17.1.0
No Known Exploit
medium severity Denial of Service (DoS)
SNYK-JAVA-COMGOOGLEPROTOBUF-3040284		   499   No Known Exploit
medium severity Improper Certificate Validation
SNYK-JAVA-COMMONSHTTPCLIENT-30083		   484   No Known Exploit
medium severity Security Bypass
SNYK-JAVA-ORGAPACHEDERBY-32274		   479   org.apache.hive:hive-metastore:
2.3.7 -> 3.0.0
No Known Exploit
medium severity Man-in-the-Middle (MitM)
SNYK-JAVA-COMMONSHTTPCLIENT-31660		   429   No Known Exploit
low severity Information Exposure
SNYK-JAVA-COMMONSCODEC-561518		   399   No Known Exploit
low severity Man-in-the-Middle (MitM)
SNYK-JAVA-LOG4J-1300176		   399   No Known Exploit
low severity Improper Input Validation
SNYK-JAVA-ORGAPACHEAVRO-5926693		   399   org.apache.avro:avro:
1.8.2 -> 1.11.4
org.apache.avro:avro-mapred:
1.8.2 -> 1.11.4
No Known Exploit

Vulnerabilities that could not be fixed

  • Upgrade:
    • Could not upgrade org.apache.spark:spark-core_2.12@3.0.2-SNAPSHOT to org.apache.spark:spark-core_2.12@3.5.5; Reason could not apply upgrade, dependency is managed externally ; Location: provenance does not contain location
  • Could not upgrade org.apache.spark:spark-sql_2.12@3.0.2-SNAPSHOT to org.apache.spark:spark-sql_2.12@3.5.2; Reason could not apply upgrade, dependency is managed externally ; Location: provenance does not contain location

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Information Exposure
🦉 Denial of Service (DoS)
🦉 XML External Entity (XXE) Injection
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: pom.xml to reduce vulnerabilities
8502c17 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-572732
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2342645
- https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJACKSON-3326362
- https://snyk.io/vuln/SNYK-JAVA-ORGXERIALSNAPPY-5918282
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEAVRO-8161188
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEPROTOBUF-173761
- https://snyk.io/vuln/SNYK-JAVA-COMMONSLANG-10734077
- https://snyk.io/vuln/SNYK-JAVA-COMMONSIO-1277109
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2316893
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-10500754
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-7569538
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEPROTOBUF-8055227
- https://snyk.io/vuln/SNYK-JAVA-COMMONSBEANUTILS-10259368
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-1048302
- https://snyk.io/vuln/SNYK-JAVA-IOAIRLIFT-7164637
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEIVY-5847858
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2342646
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-2342647
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECOMMONS-6254296
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEVELOCITY-3116414
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEZOOKEEPER-5961102
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038424
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-3038426
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-2421244
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEPROTOBUF-2331703
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEPROTOBUF-3167772
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECOMMONS-1316641
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEIVY-3106929
- https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJACKSON-534878
- https://snyk.io/vuln/SNYK-JAVA-ORGGLASSFISHJERSEYMEDIA-595972
- https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONCORE-10332631
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHIVE-8663471
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEIVY-3106014
- https://snyk.io/vuln/SNYK-JAVA-COMMONSCONFIGURATION-10116124
- https://snyk.io/vuln/SNYK-JAVA-COMMONSIO-8161190
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHADOOP-8089372
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEHIVE-8664881
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEDIRECTORYSERVER-1063040
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLECODEGSON-1730327
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECOMMONS-1316638
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECOMMONS-1316639
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHECOMMONS-1316640
- https://snyk.io/vuln/SNYK-JAVA-ORGGLASSFISHJERSEYCORE-1255637
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-3358774
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEDERBY-6069877
- https://snyk.io/vuln/SNYK-JAVA-COMGOOGLEPROTOBUF-3040284
- https://snyk.io/vuln/SNYK-JAVA-COMMONSHTTPCLIENT-30083
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEDERBY-32274
- https://snyk.io/vuln/SNYK-JAVA-COMMONSHTTPCLIENT-31660
- https://snyk.io/vuln/SNYK-JAVA-COMMONSCODEC-561518
- https://snyk.io/vuln/SNYK-JAVA-LOG4J-1300176
- https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEAVRO-5926693
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jdelamar @snyk-bot