[IMPALA-11670] Upgrade components for CVEs, make it easier to override versions

• Type: Task
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: Impala 4.1.0
• Fix Version/s: Impala 4.2.0
• Epic Color: ghx-label-1
• Assignee: Michael Smith
• Reporter: Michael Smith
• Created: 17/Oct/22 22:07
• Updated: 31/Oct/22 04:48
• Resolved: 19/Oct/22 17:04

Description

Upgrade guava and jackson-databind for

• guava: CVE-2020-8908
• jackson-databind: CVE-2022-42003, CVE-2022-42004

Also make it easier to override versions of commonly updated dependencies by declaring the version as environment variables in impala-config.sh (so that impala-branch-config.sh can override it as needed).