hadoop-huaweicloud (the Huawei OBS connector) has received no meaningful updates since it was added to Hadoop in 2021:
https://github.com/apache/hadoop/commits/trunk/hadoop-cloud-storage-project/hadoop-huaweicloud
Spark has zero source code, tests, or documentation that reference it; it was a pure transitive dependency bundled via the hadoop-cloud module.
It pulls in okhttp 3.12.12, which is flagged by CVE-2021-0341 (hostname verification bypass in OkHostnameVerifier). Upgrading okhttp is problematic: 4.x is Kotlin-based and drags in kotlin-stdlib and okio 2.x/3.x, creating a dependency management challenge where the net advisory count can go up rather than down depending on the version chosen.
The cleanest fix is to remove hadoop-huaweicloud entirely, which eliminates the CVE along with the entire okhttp/okio/kotlin transitive tree.
Scope of work:
- Remove hadoop-huaweicloud dependency from hadoop-cloud/pom.xml
- Keep the exclusion from hadoop-cloud-storage (it pulls huaweicloud transitively)
- Remove okhttp and okio dependencies and version properties
- Remove huaweicloud.deps.scope property from root pom.xml
- Remove huaweicloud-provided profile
- Remove okhttp/okio from LICENSE-binary and dependency manifest
This is not a backport candidate: Spark is not meaningfully affected on supported default paths, and the connector saw no usage in Spark's codebase.
hadoop-huaweicloud (the Huawei OBS connector) has received no meaningful updates since it was added to Hadoop in 2021:
https://github.com/apache/hadoop/commits/trunk/hadoop-cloud-storage-project/hadoop-huaweicloud
Spark has zero source code, tests, or documentation that reference it; it was a pure transitive dependency bundled via the hadoop-cloud module.
It pulls in okhttp 3.12.12, which is flagged by CVE-2021-0341 (hostname verification bypass in
OkHostnameVerifier). Upgrading okhttp is problematic: 4.x is Kotlin-based and drags in kotlin-stdlib and okio 2.x/3.x, creating a dependency management challenge where the net advisory count can go up rather than down depending on the version chosen.The cleanest fix is to remove hadoop-huaweicloud entirely, which eliminates the CVE along with the entire okhttp/okio/kotlin transitive tree.
Scope of work:
This is not a backport candidate: Spark is not meaningfully affected on supported default paths, and the connector saw no usage in Spark's codebase.