Potential secutiry vulnerability in the shared library zstd. Can you help upgrade to patch versions?

[HelenParr]

Hi, @erikerlandson , @JonathanTaws , I'd like to report a vulnerable dependency in org.isarnproject:isarn-sketches-spark_2.12:0.5.2-sp3.0.

Issue Description

I noticed that org.isarnproject:isarn-sketches-spark_2.12:0.5.2-sp3.0 directly depends on org.apache.spark:spark-core_2.12:3.0.1 in the pom. However, as shown in the following dependency graph, org.apache.spark:spark-core_2.12:3.0.1 sufferes from the vulnerability which the C library zstd(version:1.4.4) exposed: CVE-2021-24032.

Dependency Graph between Java and Shared Libraries

Suggested Vulnerability Patch Versions

org.apache.spark:spark-core_2.12:3.2.0 (>=3.2.0) has upgraded this vulnerable C library zstd to the patch version 1.5.0.

Java build tools cannot report vulnerable C libraries, which may induce potential security issues to many downstream Java projects. Could you please upgrade this vulnerable dependency?

Thanks for your help~
Best regards,
Helen Parr

[erikerlandson]

@HelenParr I will try to test the upgrade this weekend and release

[erikerlandson]

Apologies for the substantial delay, I have published a spark-3.2 release-candidate: 0.6.0-RC1-sp3.2