[HIVE-26841] Upgrade avatica to 1.22.0

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Won't Fix
• Affects Version/s: 4.0.0-alpha-2
• Fix Version/s: Not Applicable
• Target Version/s: 4.0.0-alpha-2
• Assignee: Raghav Aggarwal
• Reporter: Raghav Aggarwal
• Created: 13/Dec/22 16:22
• Updated: 09/May/24 14:59
• Resolved: 09/May/24 14:59

Description

To resolve CVE-2022-36364 Avatica needs to be upgraded.

 Apache Calcite Avatica JDBC driver httpclient_impl connection property can be used as an RCE vector. Users of previous versions of Avatica MUST upgrade to mitigate this vulnerability. For more info please see the entry in the CVE database: CVE-2022-36364.

Issue Links

• relates to: HIVE-26610 Upgrade calcite-core to 1.32.0