Address CVEs in transitive HBase 1x dependencies

This project depends on interfaces and value types from HBase to create a compatibility layer from the HBase api to Cloud Bigtable service. Unfortunately HBase does not provide an interface only artifact, instead it provides 2 client artifacts: hbase-client and hbase-shaded-client. hbase-shaded-client shades most of its dependencies to avoid classpath conflicts. java-bigtable-hbase has to depend on hbase-shaded-client to avoid dependency conflicts from very old versions of guava and protobuf.

One of some of the dependencies that hbase-shaded-client shades is the hadoop-common 2.8.5. This artifact has a known CVE related to its shell escaping of the tar command. Although this CVE cannot be activated by Cloud Bigtable (java-bigtable-hbase doesn't do anything with tar files), this will create alerts for endusers.

The problem is a bit difficult to solve because the HBase 1x is no longer supported by the HBase project, so apache will not release a new version. In the meantime for end users that have strict security policies we recommend to migrate to HBase 2x apis via bigable-hbase-2x (regular, shaded or hadoop). For end users of CloudBigtableIO, I would recommend to use the native (nonhbase) BigtableIO connector until we release a version compatible with HBase 2x.

Beginne mit der Überprüfung der Abhängigkeitsdeklarationen für hbase-shaded-client und seine transitive hadoop-common 2.8.5-Abhängigkeit. Bestätige anschließend die gemeldete CVE zur Shell-Escaping-Schwachstelle in tar und ihre Erreichbarkeit in dieser Bibliothek. Als abgeschlossen gilt die Aufgabe, wenn eine unterstützte Behebung vorhanden ist, die den Hinweis für Endbenutzer entfernt, ohne die HBase 1.x-Kompatibilitätsschicht zu beschädigen; das Issue nennt keine Dateien oder Tests.

Vom Indexierungsmodell aus dem Issue-Text verfasst.