CVE-2022-26612: Apache Hadoop: Arbitrary file write in FileUtil#unpackEntries on Windows

[ppalaga]

See https://lists.apache.org/thread/hslo7wzw2449gv1jyjk8g6ttd7935fyz We should avoid using org.apache.hadoop:hadoop-common older than 3.2.3

$ mvn org.l2x6.cq:cq-prod-maven-plugin:2.23.0:find-dependency -N -e '-Dcq.gavPattern=org.apache.hadoop:hadoop-common'
...
[WARNING] Found org.apache.camel.quarkus:camel-quarkus-hbase:2.9.0-SNAPSHOT:jar:
        -> org.apache.camel:camel-hbase:3.16.0:jar:
        -> org.apache.hbase:hbase-client:2.4.10:jar:
        -> org.apache.hadoop:hadoop-common:2.10.0:jar:
...
[WARNING] Found org.apache.camel.quarkus:camel-quarkus-hdfs:2.9.0-SNAPSHOT:jar:
        -> org.apache.camel:camel-hdfs:3.16.0:jar:
        -> org.apache.hadoop:hadoop-common:3.3.2:jar:
...
[WARNING] Found org.apache.camel.quarkus:camel-quarkus-spark:2.9.0-SNAPSHOT:jar:
        -> org.apache.camel:camel-spark:3.16.0:jar:
        -> org.apache.hadoop:hadoop-common:3.3.2:jar:
...

[jamesnetherton]

I wonder if we should deprecate and remove hdfs & hbase? Hadoop is a massive bucket of stuff that seems to have no real dependency alignment or convergence management. Coupled with the fact these extensions are using different Hadoop versions, it makes maintaining them quite painful.

[aldettinger]

I agree we should deprecate them. Plus the hadoop community is not responsive about security. Plus we are relying on old versions without possibility to upgrade (at least for hbase). https://issues.apache.org/jira/browse/CAMEL-18246 https://issues.apache.org/jira/browse/HADOOP-18317

What would you think about deprecating the spark extension too ?

[jamesnetherton]

What would you think about deprecating the spark extension too ?

We already removed Spark in 2.10.0 👍

[ppalaga]

I wonder if we should deprecate and remove hdfs & hbase? Hadoop is a massive bucket of stuff that seems to have no real dependency alignment or convergence management. Coupled with the fact these extensions are using different Hadoop versions, it makes maintaining them quite painful.

I agree they are hard to maintain. Do you know if there were any discussions on Camel level to remove those? Ideally they should be agreed for deprecation and removal in Camel.

[aldettinger]

There was discussion in camel upstream to talk about deprecating spark, hbase and hdfs:

• camel-spark (will be deprecated in camel, already removed in camel-quarkus)
• camel-hbase (will be deprecated in camel, we could deprecate as well in camel-quarkus)

Concerning camel-hdfs, the deprecation is reported in camel as there is community interest. Now come the question of the maintenance in camel-quarkus:

• This CVE should be fixed
• I think we would have a single hadoop version left as we remove hbase
• However I don't know how bad alignement/convergence could still be

At this stage, I would report the deprecation of camel-quarkus-hdfs and reconsider when we hit another big maintenance issue.

@jamesnetherton @ppalaga What do you think ?

[ppalaga]

+1 for deprecating both hdfs and hbase

[aldettinger]

Ok, let's deprecate both in Camel Quarkus then. We could come back if there is a strong community involvement to narrow down the maintenance burden in the future.

[zbendhiba]

+1 for deprecating

[aldettinger]

hbase has been partly deprecated in camel-quarkus commit https://github.com/apache/camel-quarkus/commit/bbbee804a215072c217912ffbf922a2438453c52