[NIFI-10716] Upgrade Flume to 1.11.0

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.19.0
• Labels: dependency-upgrade
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 28/Oct/22 02:32
• Updated: 28/Oct/22 09:16
• Resolved: 28/Oct/22 09:16

Description

The Flume Processors depend on Flume 1.10.1, which is vulnerable to CVE-2022-42468.

Although trigger the vulnerability requires a Flume configuration that includes the JMS Source with an unsafe provider URL, the dependency should be upgraded to 1.11.0 in order to mitigate potential configuration issues.

Issue Links

• links to: GitHub Pull Request #6595