Package
automq-fips
Component
guava
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Correcting the earlier note, which was wrong about Guava availability. Guava 33.7.2-jre is published and is Maven Central's current latest and release; 33.5.0-jre through 33.7.1-jre exist as well.
That fix cannot reach this finding. The Guava here is shaded inside org.apache.hadoop.thirdparty:hadoop-shaded-guava 1.3.0, which is not resolved through com.google.guava, so bumping Guava does not touch it. The newest release, hadoop-shaded-guava 1.5.0, still embeds Guava 33.4.8-jre per META-INF/maven/com.google.guava/guava/pom.properties, which is inside the vulnerable range of 4.0 through 33.7.1.
Waiting for Apache Hadoop to republish hadoop-shaded-guava against Guava 33.7.2 or later.
Status