CGA-9fpg-5p87-36m9

The spark packages include jackson-mapper-asl-1.9.13.jar and jackson-core-asl-1.9.13.jar at /usr/lib/spark/hive-jackson/, which are affected by CVE-2019-10202. These legacy CodeHaus Jackson 1.x dependencies are required for Hive UDF support and cannot be removed without breaking that functionality. Apache Spark 4.0 introduced a build-time flag (-Phive-jackson-provided) and runtime exclusion options to optionally omit these JARs, but we have not applied the build-time flag as it would disable Hive UDF support. An upstream fix that eliminates these dependencies without sacrificing Hive UDF compatibility is not yet available.

This issue concerns codehaus jackson-mapper-asl, which is no longer maintained. Spark has a transitive dependency on this library due to Hive 2.3, which requires it to initialize the FunctionRegistry. Hive 3.x, planned for Spark 4.x, should remove the dependency on codehaus-jackson. However, even if the vulnerability is fixed in Spark 4.x, it won't be possible to backport the fix to Spark 3.5.x due to its dependency on Hive 2.3. For more details: https://issues.apache.org/jira/browse/SPARK-44114, https://github.com/apache/spark/pull/40893, https://issues.apache.org/jira/browse/SPARK-30466

This relates to jackson-mapper-asl, which is no longer maintained. Apache Spark has taken actions to remove their own dependency on the library, however a transitive dependency (ranger), still requires it. Waiting for upstream https://issues.apache.org/jira/browse/NIFI-11659.