[ZOOKEEPER-4543] upgrade dependencies on branch-3.5 to avoid CVEs

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.5.9
• Fix Version/s: 3.5.10
• Labels: pull-request-available
• Assignee: Mate Szalay-Beko
• Reporter: Mate Szalay-Beko
• Created: 17/May/22 11:59
• Updated: 11/Jul/22 07:23
• Resolved: 17/May/22 16:55

Description

The aim of this ticket to fix all CVEs on branch-3.5 before the last 3.5.10 release. 

branch-3.5 is quite outdated when it comes to CVE fixes. I already backported
ZOOKEEPER-4455 (remove log4j and add reload4j) but other dependencies are also outdated. Most probably the dependency plugin also needs to be updated  to avoid the netty-transport related false-positive CVEs.
 
 

Issue Links

• links to: GitHub Pull Request #1878