Star0
8
代码
代码
Issues16
Pull Requests12
项目讨论
Wiki
分析
Star0
8
已开启
fix CVE-2025-27821 #139
pop-code123创建于 6月9日
fix CVE-2025-27821 #139
已开启
pop-code123创建于 6月9日
从pop-code123/hadoopCVE-fix-SP3合入到src-openeuler/hadoopopenEuler-24.03-LTS-SP4
共 2 个文件变更+83-1
A06-backport-CVE-2025-27821.patch+78-0
@@ -0,0 +1,78 @@
1+From 6059471fc7086229fea9d54c0bf8def00c9c03fa Mon Sep 17 00:00:00 2001
2+From: Chris Nauroth <cnauroth@apache.org>
3+Date: Fri, 7 Mar 2025 18:31:55 +0000
4+Subject: [PATCH] HDFS-17754: Add uriparser2 to notices
5+ 
6+---
7+ NOTICE-binary | 11 +++++++++--
8+ .../uriparser2/uriparser/UriQuery.c | 1 +
9+ licenses-binary/LICENSE-uriparser2.txt | 19 +++++++++++++++++++
10+ 3 files changed, 29 insertions(+), 2 deletions(-)
11+ create mode 100644 licenses-binary/LICENSE-uriparser2.txt
12+ 
13+diff --git a/NOTICE-binary b/NOTICE-binary
14+index 2189de34..b1e1dc76 100644
15+--- a/NOTICE-binary
16++++ b/NOTICE-binary
17+@@ -822,7 +822,7 @@ This product includes software developed by Apache
18+ PureJavaCrc32C from apache-hadoop-common http://hadoop.apache.org/
19+ (Apache 2.0 license)
20+
21+-This library containd statically linked libstdc++. This inclusion is allowed by
22++This library contains statically linked libstdc++. This inclusion is allowed by
23+ "GCC RUntime Library Exception"
24+ http://gcc.gnu.org/onlinedocs/libstdc++/manual/license.html
25+
26+@@ -890,4 +890,11 @@ may have restrictions on the import, possession, and use, and/or re-export to
27+ another country, of encryption software. BEFORE using any encryption software,
28+ please check the country's laws, regulations and policies concerning the import,
29+ possession, or use, and re-export of encryption software, to see if this is
30+-permitted.
31+ 
32++permitted.
33++
34++This product includes code from uriparser2, a C and C++ library for URI parsing.
35++
36++ * LICENSE:
37++ * license/LICENSE-uriparser2.txt (MIT License)
38++ * HOMEPAGE:
39++ * https://github.com/bnoordhuis/uriparser2
40+diff --git a/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/third_party/uriparser2/uriparser2/uriparser/UriQuery.c b/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/third_party/uriparser2/uriparser2/uriparser/UriQuery.c
41+index 7cb031dd..35793d20 100644
42+--- a/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/third_party/uriparser2/uriparser2/uriparser/UriQuery.c
43++++ b/hadoop-hdfs-project/hadoop-hdfs-native-client/src/main/native/libhdfspp/third_party/uriparser2/uriparser2/uriparser/UriQuery.c
44+@@ -219,6 +219,7 @@ int URI_FUNC(ComposeQueryEngine)(URI_CHAR * dest,
45+
46+ /* Copy key */
47+ if (firstItem == URI_TRUE) {
48++ ampersandLen = 1;
49+ firstItem = URI_FALSE;
50+ } else {
51+ write[0] = _UT('&');
52+diff --git a/licenses-binary/LICENSE-uriparser2.txt b/licenses-binary/LICENSE-uriparser2.txt
53+new file mode 100644
54+index 00000000..c662ad5d
55+--- /dev/null
56++++ b/licenses-binary/LICENSE-uriparser2.txt
57+@@ -0,0 +1,19 @@
58++Copyright (c) 2010 Ben Noordhuis
59++
60++Permission is hereby granted, free of charge, to any person obtaining a copy
61++of this software and associated documentation files (the "Software"), to deal
62++in the Software without restriction, including without limitation the rights
63++to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
64++copies of the Software, and to permit persons to whom the Software is
65++furnished to do so, subject to the following conditions:
66++
67++The above copyright notice and this permission notice shall be included in
68++all copies or substantial portions of the Software.
69++
70++THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
71++IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
72++FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
73++AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
74++LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
75++OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
76++THE SOFTWARE.
77+--
78+2.33.0
Mhadoop.spec+5-1
@@ -13,7 +13,7 @@
13 13 
14Name: hadoop14Name: hadoop
15Version: 3.3.615Version: 3.3.6
16-Release: 716+Release: 8
17Summary: A software platform for processing vast amounts of data17Summary: A software platform for processing vast amounts of data
18# The BSD license file is missing18# The BSD license file is missing
19# https://issues.apache.org/jira/browse/HADOOP-984919# https://issues.apache.org/jira/browse/HADOOP-9849
@@ -44,6 +44,7 @@ Patch1: 02-Upgrade-os-maven-plugin-to-1.7.1.patch
44Patch2: 03-Fix-build-on-riscv.patch44Patch2: 03-Fix-build-on-riscv.patch
45Patch3: 04-Enhance-access-control-for-RunJar.patch45Patch3: 04-Enhance-access-control-for-RunJar.patch
46Patch4: 05-c-code-adapt-to-gcc14.patch46Patch4: 05-c-code-adapt-to-gcc14.patch
47+Patch5: 06-backport-CVE-2025-27821.patch
47 48 
48BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root49BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
49BuildRequires: java-1.8.0-openjdk-devel maven hostname maven-local tomcat cmake snappy openssl-devel50BuildRequires: java-1.8.0-openjdk-devel maven hostname maven-local tomcat cmake snappy openssl-devel
@@ -1163,6 +1164,9 @@ fi
1163%config(noreplace) %{_sysconfdir}/%{name}/container-executor.cfg1164%config(noreplace) %{_sysconfdir}/%{name}/container-executor.cfg
1164 1165 
1165%changelog1166%changelog
1167+* Tue Jun 9 2026 puhongyu <puhongyu@kylinsec.com.cn> - 3.3.6-8
1168+- fix CVE-2025-27821
1169+ 
1166* Fri Nov 07 2025 laokz <zhangkai@iscas.ac.cn> - 3.3.6-71170* Fri Nov 07 2025 laokz <zhangkai@iscas.ac.cn> - 3.3.6-7
1167- C code adapt to gcc141171- C code adapt to gcc14
1168 1172