[NIFI-2798] Upgrade Zookeeper version due to CVE-2016-5017

• Type: Task
• Status: Resolved
• Priority: Critical
• Resolution: Not A Problem
• Affects Version/s: 1.0.0, 0.7.0
• Component/s: Core Framework
• Labels: cve security zookeeper
• Assignee: Unassigned
• Reporter: Andy LoPresto
• Created: 21/Sep/16 00:12
• Updated: 22/Nov/16 05:12
• Resolved: 13/Oct/16 16:57

Description

The currently used version of Zookeeper 3.4.6 is subject to a buffer overflow attack using the C command-line interface (documented as CVE-2016-5017 [1]). Version 3.4.9 patches this issue. In nifi/pom.xml, this version number should be updated, and basic compatibility/smoke tests should be run to ensure no new issues are introduced by the version increment.

[1] https://zookeeper.apache.org/security.html#CVE-2016-5017