Package
hadoop-fips-3.5
Component
netty-transport-sctp
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
netty-transport-sctp 4.1.131.Final is shaded inside hbase-shaded-client-byo-hadoop-2.6.6-hadoop3.jar (hbase 2.6.6-hadoop3 / hbase-thirdparty 4.1.13). The fix is in netty 4.1.137.Final; hbase 2.6.6-hadoop3 and hbase-thirdparty 4.1.14 are the newest releases and both still shade netty 4.1.131.Final, and the classes live inside published uber jars that dependencyManagement cannot rewrite. Pending an upstream hbase-thirdparty release with a fixed netty and an hbase release consuming it.
Status
Previous location
/usr/share/m2/repository/org/apache/hbase/hbase-shaded-client-byo-hadoop/2.6.3-hadoop3/hbase-shaded-client-byo-hadoop-2.6.3-hadoop3.jarNew location
/usr/share/m2/repository/org/apache/hbase/hbase-shaded-client-byo-hadoop/2.6.6-hadoop3/hbase-shaded-client-byo-hadoop-2.6.6-hadoop3.jarImpact
version-only path change detected during APK rebuild
Status
Impact
The affected classes are relocated inside a prebuilt third-party uber-jar retrieved from Maven Central and cached in the shipped Maven repository. Dependency management cannot rewrite classes inside a published artifact, and the newest release of the bundling artifact carries the same affected version. Remediation requires the upstream build to drop or replace the dependency that brings in that uber-jar.
Status