[FLINK-22602] Upgrade Parquet to 1.12.2

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.13.0, 1.12.3, 1.13.1
• Fix Version/s: 1.15.0
• Component/s: Formats (JSON, Avro, Parquet, ORC, SequenceFile)
• Labels: auto-deprioritized-major pull-request-available
• Assignee: Bo Cui
• Reporter: Bo Cui
• Created: 08/May/21 03:46
• Updated: 11/Jan/22 15:12
• Resolved: 11/Jan/22 15:12

Description

We scanned jackson-databind&core for some vulnerabilities (CVE-2020-24616/CVE-2021-20190/CVE-2020-36184/CVE-2020-36183/CVE-2020-9546...). Apache Parquet depends on them, so we upgraded parquet to version 1.12.0.

 

parquet code link：https://github.com/apache/parquet-mr/blob/db75a6815f2ba1d1ee89d1a90aeb296f1f3a8f20/pom.xml#L78

Issue Links

• links to: GitHub Pull Request #15861