Skip to content

fix(hadoop): Upgrade nimbus-jose-jwt in Hadoop to fix CVE-2025-53864 #1245

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
xeniape merged 3 commits into from
Sep 11, 2025
Merged

fix(hadoop): Upgrade nimbus-jose-jwt in Hadoop to fix CVE-2025-53864 #1245

xeniape merged 3 commits into from
Sep 11, 2025

Conversation

@xeniape
Copy link
Member

@xeniape xeniape commented Sep 10, 2025 •
edited
Loading

Description

This PR upgrades the nimbus-jose-jwt dependency to 9.37.4 in Hadoop to fix CVE-2025-53864.
Similar to https://www.github.com/apache/hadoop/pull/7870

Integrationtest (HDFS)

--- PASS: kuttl (4028.55s)
    --- PASS: kuttl/harness (0.00s)
        --- PASS: kuttl/harness/smoke_hadoop-3.4.1_zookeeper-3.9.3_zookeeper-latest-3.9.3_number-of-datanodes-2_datanode-pvcs-2hdd-1ssd_listener-class-external-unstable_openshift-false (299.91s)
        --- PASS: kuttl/harness/smoke_hadoop-3.4.1_zookeeper-3.9.3_zookeeper-latest-3.9.3_number-of-datanodes-1_datanode-pvcs-2hdd-1ssd_listener-class-cluster-internal_openshift-false (156.74s)
        --- PASS: kuttl/harness/smoke_hadoop-3.4.1_zookeeper-3.9.3_zookeeper-latest-3.9.3_number-of-datanodes-2_datanode-pvcs-2hdd-1ssd_listener-class-cluster-internal_openshift-false (936.06s)
        --- PASS: kuttl/harness/kerberos_hadoop-3.4.1_zookeeper-latest-3.9.3_krb5-1.21.1_opa-1.4.2_kerberos-realm-CLUSTER.LOCAL_kerberos-backend-mit_openshift-false (1397.93s)
        --- PASS: kuttl/harness/smoke_hadoop-3.4.1_zookeeper-3.9.3_zookeeper-latest-3.9.3_number-of-datanodes-1_datanode-pvcs-default_listener-class-external-unstable_openshift-false (167.60s)
        --- PASS: kuttl/harness/smoke_hadoop-3.4.1_zookeeper-3.9.3_zookeeper-latest-3.9.3_number-of-datanodes-1_datanode-pvcs-default_listener-class-cluster-internal_openshift-false (180.79s)
        --- PASS: kuttl/harness/smoke_hadoop-3.4.1_zookeeper-3.9.3_zookeeper-latest-3.9.3_number-of-datanodes-1_datanode-pvcs-2hdd-1ssd_listener-class-external-unstable_openshift-false (184.51s)
        --- PASS: kuttl/harness/topology-provider_hadoop-latest-3.4.1_zookeeper-latest-3.9.3_krb5-1.21.1_kerberos-backend-mit_openshift-false (355.95s)
        --- PASS: kuttl/harness/logging_hadoop-3.4.1_zookeeper-latest-3.9.3_openshift-false (690.34s)
        --- PASS: kuttl/harness/profiling_hadoop-3.4.1_zookeeper-latest-3.9.3_openshift-false (228.21s)
        --- PASS: kuttl/harness/cluster-operation_hadoop-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (206.52s)
        --- PASS: kuttl/harness/smoke_hadoop-3.4.1_zookeeper-3.9.3_zookeeper-latest-3.9.3_number-of-datanodes-2_datanode-pvcs-default_listener-class-external-unstable_openshift-false (220.20s)
        --- PASS: kuttl/harness/orphaned-resources_hadoop-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (164.18s)
        --- PASS: kuttl/harness/smoke_hadoop-3.4.1_zookeeper-3.9.3_zookeeper-latest-3.9.3_number-of-datanodes-2_datanode-pvcs-default_listener-class-cluster-internal_openshift-false (233.68s)
        --- PASS: kuttl/harness/kerberos_hadoop-3.4.1_zookeeper-latest-3.9.3_krb5-1.21.1_opa-1.4.2_kerberos-realm-PROD.MYCORP_kerberos-backend-mit_openshift-false (1388.76s)
PASS

Integrationtests (HBase)

--- FAIL: kuttl (6047.62s)
    --- FAIL: kuttl/harness (0.00s)
        --- PASS: kuttl/harness/overrides_hbase-latest-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (246.99s)
        --- PASS: kuttl/harness/external-access_hbase-2.6.1_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (292.55s)
        --- PASS: kuttl/harness/kerberos_hbase-2.6.1_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_krb5-1.21.1_listener-class-cluster-internal_kerberos-realm-PROD.MYCORP_kerberos-backend-mit_openshift-false (498.59s)
        --- PASS: kuttl/harness/kerberos_hbase-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_krb5-1.21.1_listener-class-external-unstable_kerberos-realm-PROD.MYCORP_kerberos-backend-mit_openshift-false (484.95s)
        --- PASS: kuttl/harness/kerberos_hbase-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_krb5-1.21.1_listener-class-external-unstable_kerberos-realm-CLUSTER.LOCAL_kerberos-backend-mit_openshift-false (466.20s)
        --- PASS: kuttl/harness/kerberos_hbase-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_krb5-1.21.1_listener-class-cluster-internal_kerberos-realm-PROD.MYCORP_kerberos-backend-mit_openshift-false (464.21s)
        --- PASS: kuttl/harness/kerberos_hbase-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_krb5-1.21.1_listener-class-cluster-internal_kerberos-realm-CLUSTER.LOCAL_kerberos-backend-mit_openshift-false (553.65s)
        --- PASS: kuttl/harness/kerberos_hbase-2.6.1_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_krb5-1.21.1_listener-class-external-unstable_kerberos-realm-PROD.MYCORP_kerberos-backend-mit_openshift-false (543.96s)
        --- PASS: kuttl/harness/kerberos_hbase-2.6.1_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_krb5-1.21.1_listener-class-external-unstable_kerberos-realm-CLUSTER.LOCAL_kerberos-backend-mit_openshift-false (549.37s)
        --- FAIL: kuttl/harness/shutdown_hbase-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (562.89s)
        --- PASS: kuttl/harness/cluster-operation_hbase-latest-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (307.29s)
        --- PASS: kuttl/harness/kerberos_hbase-2.6.1_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_krb5-1.21.1_listener-class-cluster-internal_kerberos-realm-CLUSTER.LOCAL_kerberos-backend-mit_openshift-false (564.14s)
        --- PASS: kuttl/harness/opa_hbase-opa-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_krb5-1.21.1_opa-1.4.2_openshift-false (309.34s)
        --- PASS: kuttl/harness/external-access_hbase-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (268.43s)
        --- PASS: kuttl/harness/shutdown_hbase-2.6.1_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (468.88s)
        --- PASS: kuttl/harness/profiling_hbase-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (260.06s)
        --- PASS: kuttl/harness/smoke_hbase-2.6.1_hdfs-3.4.1_zookeeper-3.9.3_listener-class-external-unstable_openshift-false (368.52s)
        --- PASS: kuttl/harness/smoke_hbase-2.6.1_hdfs-3.4.1_zookeeper-3.9.3_listener-class-cluster-internal_openshift-false (522.81s)
        --- FAIL: kuttl/harness/smoke_hbase-2.6.2_hdfs-3.4.1_zookeeper-3.9.3_listener-class-cluster-internal_openshift-false (560.91s)
        --- PASS: kuttl/harness/resources_hbase-latest-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (269.02s)
        --- PASS: kuttl/harness/profiling_hbase-2.6.1_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (261.22s)
        --- FAIL: kuttl/harness/omid_hbase-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false_omid-1.1.3 (359.46s)
        --- PASS: kuttl/harness/omid_hbase-2.6.1_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false_omid-1.1.3 (351.03s)
        --- PASS: kuttl/harness/snapshot-export_hbase-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (310.32s)
        --- PASS: kuttl/harness/snapshot-export_hbase-2.6.1_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (297.59s)
        --- PASS: kuttl/harness/logging_hbase-2.6.1_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (251.55s)
        --- PASS: kuttl/harness/logging_hbase-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (272.11s)
        --- PASS: kuttl/harness/orphaned_resources_hbase-latest-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (291.01s)
        --- FAIL: kuttl/harness/smoke_hbase-2.6.2_hdfs-3.4.1_zookeeper-3.9.3_listener-class-external-unstable_openshift-false (576.91s)
FAIL

--- PASS: kuttl (477.09s)
    --- PASS: kuttl/harness (0.00s)
        --- PASS: kuttl/harness/shutdown_hbase-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false (477.06s)
PASS

    logger.go:42: 19:34:52 | smoke_hbase-2.6.2_hdfs-3.4.1_zookeeper-3.9.3_listener-class-cluster-internal_openshift-false/60-test-phoenix | [SUCCESS] Phoenix test was successful!
    logger.go:42: 19:34:52 | smoke_hbase-2.6.2_hdfs-3.4.1_zookeeper-3.9.3_listener-class-cluster-internal_openshift-false/60-test-phoenix | test step completed 60-test-phoenix
    logger.go:42: 19:34:52 | smoke_hbase-2.6.2_hdfs-3.4.1_zookeeper-3.9.3_listener-class-cluster-internal_openshift-false | skipping kubernetes event logging
    logger.go:42: 19:34:52 | smoke_hbase-2.6.2_hdfs-3.4.1_zookeeper-3.9.3_listener-class-cluster-internal_openshift-false | Deleting namespace: kuttl-test-fleet-mongrel
    case.go:118: context deadline exceeded
=== NAME  kuttl
    harness.go:403: run tests finished
    harness.go:510: cleaning up
    harness.go:567: removing temp folder: ""
--- FAIL: kuttl (570.29s)
    --- FAIL: kuttl/harness (0.00s)
        --- FAIL: kuttl/harness/smoke_hbase-2.6.2_hdfs-3.4.1_zookeeper-3.9.3_listener-class-cluster-internal_openshift-false (570.28s)
FAIL
Passed but timed out on namespace delete

--- PASS: kuttl (347.23s)
    --- PASS: kuttl/harness (0.00s)
        --- PASS: kuttl/harness/omid_hbase-2.6.2_hdfs-latest-3.4.1_zookeeper-latest-3.9.3_openshift-false_omid-1.1.3 (347.21s)
PASS

--- PASS: kuttl (469.29s)
    --- PASS: kuttl/harness (0.00s)
        --- PASS: kuttl/harness/smoke_hbase-2.6.2_hdfs-3.4.1_zookeeper-3.9.3_listener-class-external-unstable_openshift-false (469.28s)
PASS

Definition of Done Checklist

Note

Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant.

Please make sure all these things are done and tick the boxes

  • Changes are OpenShift compatible
  • All added packages (via microdnf or otherwise) have a comment on why they are added
  • Things not downloaded from Red Hat repositories should be mirrored in the Stackable repository and downloaded from there
  • All packages should have (if available) signatures/hashes verified
  • Add an entry to the CHANGELOG.md file
  • Integration tests ran successfully
TIP: Running integration tests with a new product image

The image can be built and uploaded to the kind cluster with the following commands:

bake --product <product> --image-version <stackable-image-version>
kind load docker-image <image-tagged-with-the-major-version> --name=<name-of-your-test-cluster>

See the output of bake to retrieve the image tag for <image-tagged-with-the-major-version>.

@xeniape xeniape self-assigned this Sep 10, 2025
@xeniape xeniape marked this pull request as ready for review September 10, 2025 11:03
@xeniape xeniape changed the title fix(hadoop): Upgrade nimbus-jose-jwt in Hadoop 3.4.1 to fix CVE-2025-53864 fix(hadoop): Upgrade nimbus-jose-jwt in Hadoop to fix CVE-2025-53864 Sep 10, 2025
@xeniape xeniape moved this to Development: Waiting for Review in Stackable Engineering Sep 10, 2025
sbernauer
sbernauer previously approved these changes Sep 11, 2025
View reviewed changes
Copy link
Member

@sbernauer sbernauer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@sbernauer
Copy link
Member

sbernauer commented Sep 11, 2025

Not sure if I would call it a fix or a chore ;)

@sbernauer sbernauer moved this from Development: Waiting for Review to Development: In Review in Stackable Engineering Sep 11, 2025
@xeniape
Copy link
Member Author

xeniape commented Sep 11, 2025 •
edited
Loading

Not sure if I would call it a fix or a chore ;)

No strong opinion on that. Just saw earlier CVE fixes marked with fix and I guess in a sense it fixes the CVE but by doing a chore change.

@xeniape xeniape requested a review from sbernauer September 11, 2025 10:22
@xeniape xeniape added this pull request to the merge queue Sep 11, 2025
Merged via the queue into main with commit 27ce8a3 Sep 11, 2025
3 checks passed
@xeniape xeniape deleted the fix/Hadoop-CVE-2025-53864 branch September 11, 2025 14:01
@sbernauer sbernauer moved this from Development: In Review to Development: Done in Stackable Engineering Sep 15, 2025
@lfrancke lfrancke moved this from Development: Done to Done in Stackable Engineering Sep 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sbernauer sbernauer sbernauer approved these changes

Assignees

@xeniape xeniape

Labels

release/25.11.0

Projects

Stackable Engineering
Archived in project

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@xeniape @sbernauer @lfrancke