Naveen Gangam created HIVE-26566:
------------------------------------

             Summary: Upgrade H2 database version to 2.1.214
                 Key: HIVE-26566
                 URL: https://issues.apache.org/jira/browse/HIVE-26566
             Project: Hive
          Issue Type: Task
          Components: Testing Infrastructure
            Reporter: Stamatis Zampetakis
            Assignee: Stamatis Zampetakis
             Fix For: 4.0.0, 4.0.0-alpha-1


The 1.3.166 version, which is in use in Hive, suffers from the following 
security vulnerabilities:
https://nvd.nist.gov/vuln/detail/CVE-2021-42392
https://nvd.nist.gov/vuln/detail/CVE-2022-23221

In the project, we use H2 only for testing purposes (inside the jdbc-handler 
module) thus the H2 binaries are not present in the runtime classpath thus 
these CVEs do not pose a problem for Hive or its users. Nevertheless, it would 
be good to upgrade to a more recent version to avoid Hive coming up in 
vulnerability scans due to this.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

Reply via email to