Oozie
In addition to any Apache patches ported over from the 2.4.x core, HDP 2.3.6 provides Oozie 4.2.0 and the following Apache patches:
OOZIE-2492 JSON security issue in js code.
HDP 2.3.6 provides Oozie 4.2.0 and ports no additional Apache patches from the 2.4.x core.
HDP 2.3.4.7 provided Oozie 4.2.0 with no additional Apache patches.
HDP 2.3.4 provided Oozie 4.2.0 with no additional Apache patches.
HDP 2.3.2 provided Oozie 4.2.0 with no additional Apache patches.
HDP 2.3.0 provided Oozie 4.2.0 and the following Apache patches:
OOZIE-2289 hive-jdbc dependency in core/pom.xml should be compile
OOZIE-2290 Oozie db version update should happen after all DDL tweak
OOZIE-2291 Hive2 workflow.xml.security should have "cred" in action tag instead of "hive2" tag