[ZOOKEEPER-4645] Backport ZOOKEEPER-3941 (commons-cli upgrade) to branch-3.6

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.6.4
• Assignee: Mate Szalay-Beko
• Reporter: Mate Szalay-Beko
• Created: 08/Dec/22 14:22
• Updated: 09/Oct/23 11:20
• Resolved: 09/Dec/22 08:53

Description

commons-cli 1.2 is affected by a known vulnerability (). To fix it, we need to upgrade, but versions 1.3+ deprecated some classes we use in the code. In ZOOKEEPER-3941 we upgraded to commons-cli to version 1.4, but this was originally shipped only in ZooKeeper 3.7.0+.

 

To fix the CVE before the release 3.6.4, we need to update commons-cli (by backporting ZOOKEEPER-3941) on branch-3.6.

Issue Links

• blocks: ZOOKEEPER-4644 Update 3rd party library versions before release 3.6.4
• relates to: ZOOKEEPER-3941 Upgrade commons-cli to 1.4
• links to: GitHub Pull Request #1954