Package
spark-3.5-scala-2.12
Component
jackson-core
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The detected jackson-core 2.12.7 (GHSA-h46c-h94j-95f3, fixed in 2.15.0) is the copy relocated to org/apache/hadoop/shaded/com/fasterxml/jackson inside /opt/spark/jars/hadoop-client-runtime-3.3.6.jar, whose embedded pom.properties reports 2.12.7; it is the only jackson-core 2.12.7 in the package, the standalone jackson jars being 2.21.7. Hadoop 3.3.6 and 3.4.0 through 3.4.3 all shade jackson 2.12.7, and the first release shading a patched version is Hadoop 3.5.0 (jackson 2.18.6). Hadoop 3.5.0 is compiled for Java 17 while Apache Spark 3.5 supports Java 8, 11 and 17 and targets Hadoop 3.3.x, so the shaded copy cannot be raised and no fix is planned.
Status
Impact
The bundled hadoop-client-runtime-3.3.6.jar contains a relocated (shaded) copy of jackson-core 2.12.7 that is affected by GHSA-h46c-h94j-95f3; it is fixed in 2.15.0. Because the classes are shaded inside the Apache Hadoop client jar, the version cannot be raised independently. Spark 3.5 targets Hadoop 3.3.x, and Hadoop 3.3.6 and the 3.4.x releases through 3.4.3 shade jackson 2.12.7; the first release that shades a fixed version is Hadoop 3.5.0 (jackson 2.18.6), a newer line than Spark 3.5 targets, so remediation is pending a Hadoop client-runtime release on a line that Spark 3.5 supports.
Status