[FLUME-3356] Probable security issue in Flume

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.9.0
• Fix Version/s: 1.10.0
• Assignee: Unassigned
• Reporter: Manjunath Mandya Surendrakumar
• Created: 21/Feb/20 08:01
• Updated: 12/Jan/22 23:11
• Resolved: 12/Jan/22 23:11

Description

While security scanning one of my projects through WhiteSource I encountered a vulnerability by ID CVE-2019-10202 [1] from Flume 1.9.0

 

Further investigating on this, the issue was from one of your used dependency Avro 1.7.4 which is vulnerable due to the use of jackson-core-asl and jackson-mapper-asl. This issue from project Avro is fixed in version 1.9.2 [2]

 

Is this vulnerability affects Flume or Is this a known vulnerability?

Is there a plan to release a new version of Flume with updated Avro?

 

1. https://nvd.nist.gov/vuln/detail/CVE-2019-10202
2. https://mvnrepository.com/artifact/org.apache.avro/avro/1.9.2