Skip to content

[HIVE-30027] Upgrade avro from 1.12.0 to 1.12.2 vul fix #6760

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Akanksha-kedia wants to merge 2 commits into
base: master
Choose a base branch
from
+23 −1
Open

[HIVE-30027] Upgrade avro from 1.12.0 to 1.12.2 vul fix #6760

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ecc0bec
HIVE-30027: Upgrade avro from 1.12.0 to 1.12.2
Akanksha-kedia Sep 9, 2026
b4e0b7b
HIVE-30027: Trust Wikipedia SpecificRecord fixture in itests/qtest ka…
Akanksha-kedia Sep 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions itests/qtest/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -613,6 +613,14 @@
<additionalClasspathElement>${test.conf.dir}</additionalClasspathElement>
<additionalClasspathElement>${basedir}/${hive.path.to.root}/conf</additionalClasspathElement>
</additionalClasspathElements>
<!-- MiniKafkaCliConfig (kafka_storage_handler.q) produces test data via
QTestMiniClusters#getAvroRows(), which resolves the generated
org.apache.hive.kafka.Wikipedia SpecificRecord fixture. Avro's
ClassSecurityValidator (introduced in 1.12.x) forbids that resolution
unless the class is explicitly trusted. -->
<systemPropertyVariables>
<org.apache.avro.SERIALIZABLE_CLASSES>org.apache.hive.kafka.Wikipedia</org.apache.avro.SERIALIZABLE_CLASSES>
</systemPropertyVariables>
</configuration>
</plugin>
</plugins>
Expand Down
14 changes: 14 additions & 0 deletions kafka-handler/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -227,6 +227,20 @@
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<configuration>
<!-- Avro's ClassSecurityValidator reads the trusted-classes allowlist once when it is
first loaded, so it must be present as a JVM system property from fork startup;
setting it at test runtime (e.g. in @BeforeClass) is too late. Scoped to this
module's own SimpleRecord test fixture (used by AvroBytesConverterTest), not a
repo-wide trust grant. -->
<systemPropertyVariables>
<org.apache.avro.SERIALIZABLE_CLASSES>org.apache.hadoop.hive.kafka.SimpleRecord</org.apache.avro.SERIALIZABLE_CLASSES>
</systemPropertyVariables>
</configuration>
Comment on lines +230 to +242

@ayushtkn ayushtkn Sep 10, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not very straight forward, do you have idea what introduced this? I am even not sure if this is only test only fix and blast during runtime, did you reproduced it locally and verified it works by this change? I doubt

@Akanksha-kedia Akanksha-kedia Sep 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What introduced this: Avro 1.12.x added org.apache.avro.util.ClassSecurityValidator, which as of 1.12.2 rejects resolving any class as SpecificRecord unless explicitly trusted via org.apache.avro.SERIALIZABLE_CLASSES/SERIALIZABLE_PACKAGES. AvroBytesConverterTest hits this because KafkaAvroSerializer.serialize() builds a SpecificDatumWriter, which resolves this test's SimpleRecord fixture — now forbidden by default.

Reproduced locally: reverting this systemPropertyVariables change and rerunning AvroBytesConverterTest fails deterministically with:

java.lang.SecurityException: Forbidden org.apache.hadoop.hive.kafka.SimpleRecord! This class is not trusted...
  at org.apache.avro.specific.SpecificDatumWriter.<init>
  at io.confluent.kafka.serializers.AbstractKafkaAvroSerializer.serializeImpl

With it restored, mvn -pl kafka-handler test -Dtest=AvroBytesConverterTest passes 5/5.

To your "test-only" question — it's not. KafkaSerDe.AvroBytesConverter.getWritable() (the production deserialization path) builds a SpecificDatumReader, going through the identical SpecificData.getClass() check. Any real user querying Kafka Avro data via Confluent Schema Registry + code-generated SpecificRecord classes will hit the same SecurityException at runtime after this bump — this test just happens to be what caught it in CI. I didn't add a production-side trust workaround because picking that trust boundary is a real security decision (risks reintroducing the CVE this Avro change closes) and affects arbitrary user class names — not something to decide unilaterally in a version-bump PR. Wanted your take on whether this needs a Hive-side default-trust mechanism, a migration note, or should block until resolved.

</plugin>
</plugins>
<pluginManagement>
<plugins>
Expand Down
2 changes: 1 addition & 1 deletion pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@
<!-- Make sure to sync it with standalone-metastore/pom.xml -->
<antlr4.version>4.9.3</antlr4.version>
<apache-directory-server.version>2.0.0-M24</apache-directory-server.version>
<avro.version>1.12.0</avro.version>
<avro.version>1.12.2</avro.version>
<awaitility.version>4.2.1</awaitility.version>
<azure-storage-file-datalake.version>12.22.0</azure-storage-file-datalake.version>
<bcprov-jdk18on.version>1.84</bcprov-jdk18on.version>
Expand Down
Loading