[NIFI-11980] Upgrade Apache Ivy to 2.5.2

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 2.0.0-M1, 1.24.0
• Component/s: Extensions
• Labels: dependency-upgrade
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 22/Aug/23 16:45
• Updated: 22/Aug/23 17:00
• Resolved: 22/Aug/23 17:00

Description

The Scripting and Groovy extension component bundles include transitive dependencies on Apache Ivy that should be upgraded to 2.5.2. Although NiFi components do not make direct use of Apache Ivy, upgrading to version 2.5.2 addresses an XML External Entities vulnerability described in CVE-2022-46751.

Issue Links

• links to: GitHub Pull Request #7632
• links to: GitHub Pull Request #7633