Star0
8
代码
代码
Issues16
Pull Requests12
项目讨论
Wiki
分析
Star0
8
已开启
fix CVE-2025-27821 #136
zhangliang2017创建于 3月27日
fix CVE-2025-27821 #136
已开启
zhangliang2017创建于 3月27日
从zhangliang2017/hadoopopenEuler-22.03-LTS-SP4合入到src-openeuler/hadoopopenEuler-22.03-LTS-SP4
共 2 个文件变更+84-1
A03-backport-CVE-2025-27821.patch+79-0
@@ -0,0 +1,79 @@
1+From 6059471fc7086229fea9d54c0bf8def00c9c03fa Mon Sep 17 00:00:00 2001
2+From: Chris Nauroth <cnauroth@apache.org>
3+Date: Fri, 7 Mar 2025 18:31:55 +0000
4+Subject: [PATCH] HDFS-17754: Add uriparser2 to notices
5+ 
6+---
7+ NOTICE-binary | 11 +++++++++--
8+ .../uriparser2/uriparser/UriQuery.c | 1 +
9+ licenses-binary/LICENSE-uriparser2.txt | 19 +++++++++++++++++++
10+ 3 files changed, 29 insertions(+), 2 deletions(-)
11+ create mode 100644 licenses-binary/LICENSE-uriparser2.txt
12+ 
13+diff --git a/NOTICE-binary b/NOTICE-binary
14+index 2189de34..b1e1dc76 100644
15+--- a/NOTICE-binary
16++++ b/NOTICE-binary
17+@@ -822,7 +822,7 @@ This product includes software developed by Apache
18+ PureJavaCrc32C from apache-hadoop-common http://hadoop.apache.org/
19+ (Apache 2.0 license)
20+
21+-This library containd statically linked libstdc++. This inclusion is allowed by
22++This library contains statically linked libstdc++. This inclusion is allowed by
23+ "GCC RUntime Library Exception"
24+ http://gcc.gnu.org/onlinedocs/libstdc++/manual/license.html
25+
26+@@ -890,4 +890,11 @@ may have restrictions on the import, possession, and use, and/or re-export to
27+ another country, of encryption software. BEFORE using any encryption software,
28+ please check the country's laws, regulations and policies concerning the import,
29+ possession, or use, and re-export of encryption software, to see if this is
30+-permitted.
31+ 
32++permitted.
33++
34++This product includes code from uriparser2, a C and C++ library for URI parsing.
35++
36++ * LICENSE:
37++ * license/LICENSE-uriparser2.txt (MIT License)
38++ * HOMEPAGE:
39++ * https://github.com/bnoordhuis/uriparser2
40+diff --git a/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/third_party/uriparser2/uriparser2/uriparser/UriQuery.c b/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/third_party/uriparser2/uriparser2/uriparser/UriQuery.c
41+index 7cb031dd..35793d20 100644
42+--- a/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/third_party/uriparser2/uriparser2/uriparser/UriQuery.c
43++++ b/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/third_party/uriparser2/uriparser2/uriparser/UriQuery.c
44+@@ -219,6 +219,7 @@ int URI_FUNC(ComposeQueryEngine)(URI_CHAR * dest,
45+
46+ /* Copy key */
47+ if (firstItem == URI_TRUE) {
48++ ampersandLen = 1;
49+ firstItem = URI_FALSE;
50+ } else {
51+ write[0] = _UT('&');
52+diff --git a/licenses-binary/LICENSE-uriparser2.txt b/licenses-binary/LICENSE-uriparser2.txt
53+new file mode 100644
54+index 00000000..c662ad5d
55+--- /dev/null
56++++ b/licenses-binary/LICENSE-uriparser2.txt
57+@@ -0,0 +1,19 @@
58++Copyright (c) 2010 Ben Noordhuis
59++
60++Permission is hereby granted, free of charge, to any person obtaining a copy
61++of this software and associated documentation files (the "Software"), to deal
62++in the Software without restriction, including without limitation the rights
63++to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
64++copies of the Software, and to permit persons to whom the Software is
65++furnished to do so, subject to the following conditions:
66++
67++The above copyright notice and this permission notice shall be included in
68++all copies or substantial portions of the Software.
69++
70++THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
71++IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
72++FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
73++AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
74++LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
75++OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
76++THE SOFTWARE.
77+--
78+2.33.0
79+ 
Mhadoop.spec+5-1
@@ -13,7 +13,7 @@
13 13 
14Name: hadoop14Name: hadoop
15Version: 3.3.615Version: 3.3.6
16-Release: 516+Release: 6
17Summary: A software platform for processing vast amounts of data17Summary: A software platform for processing vast amounts of data
18# The BSD license file is missing18# The BSD license file is missing
19# https://issues.apache.org/jira/browse/HADOOP-984919# https://issues.apache.org/jira/browse/HADOOP-9849
@@ -39,6 +39,7 @@ Source16: node-v12.22.1-linux-arm64.tar.gz
39 39 
40Patch0: 01-lock-triple-beam-version-to-1.3.0.patch 40Patch0: 01-lock-triple-beam-version-to-1.3.0.patch
41Patch1: 02-Enhance-access-control-for-RunJar.patch41Patch1: 02-Enhance-access-control-for-RunJar.patch
42+Patch2: 03-backport-CVE-2025-27821.patch
42 43 
43BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root44BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
44BuildRequires: java-1.8.0-openjdk-devel maven hostname maven-local tomcat cmake snappy openssl-devel 45BuildRequires: java-1.8.0-openjdk-devel maven hostname maven-local tomcat cmake snappy openssl-devel
@@ -1145,6 +1146,9 @@ fi
1145%config(noreplace) %{_sysconfdir}/%{name}/container-executor.cfg1146%config(noreplace) %{_sysconfdir}/%{name}/container-executor.cfg
1146 1147 
1147%changelog1148%changelog
1149+* Fri Mar 27 2026 zhangliangpengkun <zhangliangpengkun@xfusion.com> - 3.3.6-6
1150+- fix CVE-2025-27821
1151+ 
1148* Fri Dec 13 2024 xuduo <fs-yao@126.com> - 3.3.6-51152* Fri Dec 13 2024 xuduo <fs-yao@126.com> - 3.3.6-5
1149- Add huawei repository1153- Add huawei repository
1150 1154