[CALCITE-6181] Upgrade janino to 3.1.11

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.37.0
• Labels: pull-request-available
• Assignee: Unassigned
• Reporter: Devaspati Krishnatri
• Created: 27/Dec/23 13:58
• Updated: 06/May/24 22:19
• Resolved: 30/Dec/23 04:12

Description

Upgrade Janino to 3.1.9+ due to CVE-2023-33546

janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow.

CVSSv3 Score:- 5.5(Medium)

Issue Links

• is related to: CALCITE-5361 Upgrade janino version to 3.1.9
• links to: GitHub Pull Request #3602