[FLINK-21411] The components on which Flink depends may contain vulnerabilities. If yes, fix them.

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.11.4, 1.14.0, 1.12.5, 1.13.2
• Component/s: Build System
• Labels: auto-deprioritized-major pull-request-available
• Assignee: Yun Tang
• Reporter: dgbro
• Created: 19/Feb/21 01:13
• Updated: 23/Sep/21 18:09
• Resolved: 23/Jul/21 13:58

Description

In Flink v1.11.3 contains mesos(version: 1.0.1) okhttp(version: 3.7.0) log4j(version:2.12.1) netty(version:3.10.6) jackson-databind(2.10.1) jackson(version:2.10.1) and bzip2(version:1.0.6). There are many vulnerabilities, like CVE-2017-7687,CVE-2017-9790,CVE-2018-8023,CVE-2018-20200,CVE-2020-9488,CVE-2019-20444,CVE-2019-20445,CVE-2019-16869,CVE-2020-25649,CVE-2020-25649,CVE-2019-12900,CVE-2016-3189,CVE-2018-8088 etc. please confirm these version and fix. thx

Issue Links

• relates to: FLINK-21670 Bump log4j versions (two places - 2.8.2 for Python, 2.13.2 elsewhere)
• links to: GitHub Pull Request #16568
• links to: GitHub Pull Request #16569
• links to: GitHub Pull Request #16572
• links to: GitHub Pull Request #16573