Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrading hive-dwrf version to 0.8.7 which involved upgrading snappy version to 0.5 to fix CVE-2024-36124 #24461

Merged
merged 1 commit into from
Jan 30, 2025

Conversation

namya28
Copy link
Contributor

@namya28 namya28 commented Jan 30, 2025

Description

This PR involves upgrading the hive-dwrf version to 0.8.7. The new release of the hive-dwrf version was done to fix the CVE-2024-36124 (snappy-0.2.jar) which involved upgrading the snappy version to 0.5.

The PR link to upgrade snappy in hive-dwrf : prestodb/presto-hive-dwrf#7

Motivation and Context

Impact

Test Plan

Contributor checklist

  • Please make sure your submission complies with our contributing guide, in particular code style and commit standards.
  • PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
  • Documented new properties (with its default value), SQL syntax, functions, or other functionality.
  • If release notes are required, they follow the release notes guidelines.
  • Adequate tests were added if applicable.
  • CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

Security Changes

* Upgrade the hive-dwrf version to 0.8.7 which involved upgrading snappy version to 0.5 in response to `
CVE-2024-36124 <https://github.com/advisories/GHSA-8wh2-6qhj-h7j9>`_. :pr:`24461`

@prestodb-ci prestodb-ci added the from:IBM PR from IBM label Jan 30, 2025
@namya28 namya28 changed the title upgrading hive-dwrf version to 0.8.7 Upgrading hive-dwrf version to 0.8.7 which involved upgrading snappy version to 0.5 to fix CVE-2024-36124 Jan 30, 2025
@namya28 namya28 marked this pull request as ready for review January 30, 2025 09:33
@namya28 namya28 requested a review from a team as a code owner January 30, 2025 09:33
Copy link
Member

@imjalpreet imjalpreet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@namya28 Thanks for the fix!

@imjalpreet
Copy link
Member

@tdcmeehan please take a look at this when you have some time. Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
from:IBM PR from IBM
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants