Package
pinot
Component
jline-builtins
Latest update
Fixed version
1.5.1-r21
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
1.5.1-r21Status
Impact
Fixed in jline 3.30.15 (GHSA-5q95-hrpc-m3w3, GHSA-ph9c-7hw9-vhhw, GHSA-r2xf-8xr9-62gw). The vulnerable jline 3.9.0 classes are shaded into the hadoop-client-runtime jar bundled in pinot-parquet-1.5.1-shaded.jar, unreachable via a dependency bump; no Hadoop release, including 3.5.0 and current dev branches, ships a fixed jline yet.
Status
Justification
Impact
The jline-builtins/jline-reader 3.9.0 match in pinot-parquet-1.5.1-shaded.jar comes from org.apache.hadoop:hadoop-client-runtime, which pinot-parquet shades in. Hadoop pre-relocates these JLine classes to org.apache.hadoop.shaded.org.jline.; the scanner matches them through the leftover META-INF/maven/org.jline//pom.properties (version=3.9.0). pinot-parquet uses Hadoop only through org.apache.hadoop.conf.Configuration and org.apache.hadoop.fs.Path to read Parquet files. None of its main sources (7 files at release-1.5.1) reference JLine, a terminal, or a shell, so the vulnerable JLine code is never invoked. No upstream fix exists: every hadoop-client-runtime release through 3.5.0 bundles JLine 3.9.0, and Hadoop trunk still pins jline.version to 3.9.0.
Status