[FLINK-16772] Bump derby to 10.12.1.1+ or exclude it

• Type: Improvement
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 1.10.0
• Fix Version/s: 1.10.1, 1.11.0
• Component/s: Connectors / Hive
• Labels: pull-request-available
• Assignee: Rui Li
• Reporter: Chesnay Schepler
• Created: 25/Mar/20 10:32
• Updated: 03/Apr/20 08:33
• Resolved: 03/Apr/20 08:33

Description

hive-metastore depends on derby 10.10/10.4, which are vulnerable to CVE-2015-1832.

We should bump the version to at least 10.12.1.1 .

Assuming that derby is only required for the server and not the client we could potentially even exclude it.

phoenixjiangnan Can you help with this?

Issue Links

• links to: GitHub Pull Request #11610