[HIVE-25726] Upgrade velocity to 2.3 due to CVE-2020-13936

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 4.0.0-alpha-1
• Labels: pull-request-available release-3.1.3
• Assignee: Sourabh Goyal
• Reporter: Sourabh Goyal
• Created: 19/Nov/21 11:08
• Updated: 20/Aug/24 16:40
• Resolved: 10/Jan/22 19:08

Description

Velocity project announced CVE-2020-13936 on 20210309 and through NVD 20210317 to get detected internally.

• https://nvd.nist.gov/vuln/detail/CVE-2020-13936
• http://velocity.apache.org/news.html

Issue Links

• links to: GitHub Pull Request #2805
• links to: GitHub Pull Request #4308