[FLINK-33238] Upgrade org.apache.avro:avro to 1.11.3 to mitigate CVE-2023-39410

• Type: Technical Debt
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: kafka-3.1.0, 1.19.0, 1.18.1
• Component/s: Connectors / Kafka, Formats (JSON, Avro, Parquet, ORC, SequenceFile)
• Labels: pull-request-available
• Assignee: Martijn Visser
• Reporter: Martijn Visser
• Created: 11/Oct/23 09:47
• Updated: 23/Oct/23 06:29
• Resolved: 23/Oct/23 06:29

Description

We should update AVRO to 1.11.3 to avoid false-positives on CVE-2023-39410

Issue Links

• fixes: FLINK-33303 [flink-avro] Union type not inheriting type conversions
• links to: GitHub Pull Request #59
• links to: GitHub Pull Request #23508
• links to: GitHub Pull Request #23559