[Security/Dependency] Bump org.apache.ranger:ranger-plugins-common to 2.4.0+ in juicefs-hadoop to resolve CVE-2022-45048

[smittal8-at]

What happened?

Our Software Composition Analysis (SCA) scanners are flagging the io.juicefs:juicefs-hadoop dependency because it pulls in a vulnerable version of Apache Ranger plugins (org.apache.ranger:ranger-plugins-common:2.3.0).

Apache Ranger 2.3.0 contains known high-severity vulnerabilities, most notably:

• CVE-2022-45048 (CVSS 8.8) - Remote Code Execution (RCE) via malicious policies.
• CVE-2021-40331 (CVSS 8.1) - Incorrect Permission Assignment.

What is the expected behavior?

The Ranger dependencies in the juicefs-hadoop SDK should be bumped to a secure version. The Apache Software Foundation has resolved these vulnerabilities in Apache Ranger 2.4.0 and newer.

Could the maintainers please update the ranger.version property (or equivalent) for the Hadoop SDK to 2.4.0 or 2.5.0 in an upcoming release to clear these security flags?

Additional Context

• Affected Component: juicefs/sdk/java (JuiceFS Hadoop Java SDK)
• Current Vulnerable Dependency: org.apache.ranger:ranger-plugins-common:2.3.0
• Suggested Fix: Bump to 2.4.0 or 2.5.0

[Xuyuchao-juice]

ok. This issue is being tracked to ensure its completion.