CVEs in the dependencies are in the execution path of your project

Hello,
Your project uses some dependencies with CVEs. I found that the buggy methods of the CVEs are in the program execution path of your project, which makes your project at risk. I have suggested some version updates. Here is the detailed information:

* **Vulnerable Dependency:** org.apache.hadoop : hadoop-common : 2.7.3

* **Call Chain to Buggy Methods:**

* **Some files in your project call the library method org.apache.hadoop.conf.Configuration.get(java.lang.String,java.lang.String), which can reach the buggy method of [CVE-2017-15713](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15713).**

* Files in your project:
angel-ps/core/src/main/java/com/tencent/angel/psagent/PSAgent.java
(The rest of the 35 files is hidden)

* One of the possible call chain:

```
org.apache.hadoop.conf.Configuration.get(java.lang.String,java.lang.String)
org.apache.hadoop.conf.Configuration.substituteVars(java.lang.String) [buggy method]
```

* **Some files in your project call the library method org.apache.hadoop.conf.Configuration.getFloat(java.lang.String,float), which can reach the buggy method of [CVE-2017-15713](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15713).**

* Files in your project:
angel-ps/core/src/main/java/com/tencent/angel/master/yarn/util/ParameterServerJVM.java, angel-ps/core/src/main/java/com/tencent/angel/ps/ParameterServer.java, angel-ps/core/src/main/java/com/tencent/angel/ps/server/data/RunningContext.java, angel-ps/core/src/main/java/com/tencent/angel/master/yarn/util/WorkerJVM.java, angel-ps/core/src/main/java/com/tencent/angel/data/inputformat/BalanceInputFormatV2.java

* One of the possible call chain:

```
org.apache.hadoop.conf.Configuration.getFloat(java.lang.String,float)
org.apache.hadoop.conf.Configuration.getTrimmed(java.lang.String)
org.apache.hadoop.conf.Configuration.get(java.lang.String)
org.apache.hadoop.conf.Configuration.substituteVars(java.lang.String) [buggy method]
```

* **Some files in your project call the library method org.apache.hadoop.conf.Configuration.getInt(java.lang.String,int), which can reach the buggy method of [CVE-2017-15713](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15713).**

* Files in your project:
angel-ps/core/src/main/java/com/tencent/angel/psagent/PSAgent.java
(The rest of the 63 files is hidden)

* One of the possible call chain:

```
org.apache.hadoop.conf.Configuration.getInt(java.lang.String,int)
org.apache.hadoop.conf.Configuration.getTrimmed(java.lang.String)
org.apache.hadoop.conf.Configuration.get(java.lang.String)
org.apache.hadoop.conf.Configuration.substituteVars(java.lang.String) [buggy method]
```

* **Some files in your project call the library method org.apache.hadoop.security.UserGroupInformation.setConfiguration(org.apache.hadoop.conf.Configuration), which can reach the buggy method of [CVE-2017-15713](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15713).**

* Files in your project:
angel-ps/core/src/main/java/com/tencent/angel/ps/ParameterServer.java, angel-ps/core/src/main/java/com/tencent/angel/utils/AngelRunJar.java, angel-ps/core/src/main/java/com/tencent/angel/master/AngelApplicationMaster.java

* One of the possible call chain:

```
org.apache.hadoop.security.UserGroupInformation.setConfiguration(org.apache.hadoop.conf.Configuration)
org.apache.hadoop.security.UserGroupInformation.initialize(org.apache.hadoop.conf.Configuration,boolean)
org.apache.hadoop.security.SecurityUtil.getAuthenticationMethod(org.apache.hadoop.conf.Configuration)
org.apache.hadoop.conf.Configuration.get(java.lang.String,java.lang.String)
org.apache.hadoop.conf.Configuration.substituteVars(java.lang.String) [buggy method]
```

* **Some files in your project call the library method org.apache.hadoop.conf.Configuration.getBoolean(java.lang.String,boolean), which can reach the buggy method of [CVE-2017-15713](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15713).**

* Files in your project:
angel-ps/core/src/main/java/com/tencent/angel/master/yarn/util/ParameterServerJVM.java
(The rest of the 22 files is hidden)

* One of the possible call chain:

```
org.apache.hadoop.conf.Configuration.getBoolean(java.lang.String,boolean)
org.apache.hadoop.conf.Configuration.getTrimmed(java.lang.String)
org.apache.hadoop.conf.Configuration.get(java.lang.String)
org.apache.hadoop.conf.Configuration.substituteVars(java.lang.String) [buggy method]
```

(Other called library methods are not listed for reasons of length.)

* **Update suggestion:** version 3.2.0
3.2.0 is a safe version without CVEs. From 2.7.3 to 3.2.0, 1 of the APIs (called by 1 time in your project) was removed, 53 APIs (called by 1653 times in your project) were modified.