[FLINK-36800] Upgrade hadoop-aws to avoid CVE-2019-14887

• Type: Bug
• Status: In Progress
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.18.1, 1.20.0, 1.19.1, 2.0-preview
• Component/s: Connectors / FileSystem
• Labels: pull-request-available
• Assignee: Fabian Paul
• Reporter: Fabian Paul
• Created: 26/Nov/24 11:18
• Updated: 29/Nov/24 09:09

Description

wildfly-openssl is used as SSL provider by hadoop-aws.

 

Currently, Flink depends on hadoop-aws 3.3.4 including wildfly-openssl 1.0.7 being vulnerable. We should update hadoop-aws to include a later version of the SSL provider.

Issue Links

• links to: GitHub Pull Request #25692