[FLINK-15554] Bump jetty-util-ajax to 9.3.24

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.9.2, 1.10.0
• Component/s: Build System, Connectors / FileSystem
• Labels: pull-request-available
• Assignee: Chesnay Schepler
• Reporter: Chesnay Schepler
• Created: 10/Jan/20 13:55
• Updated: 15/Jan/20 11:00
• Resolved: 15/Jan/20 11:00

Description

flink-fs-hadoop-azure has transitive dependency on jetty-util-ajax:9.3.19, which has a security vulnerability: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7657

This was fixed in 9.3.24.v20180605 (source). Starting from version 3.2.1 hadoop-azure is using this version as well, but for a quick resolution I propose bumping this single dependency for the time being.

Issue Links

• links to: GitHub Pull Request #10830
• links to: GitHub PullRequest