[jira] [Comment Edited] (FLINK-38193) Upgrade org.apache.commons:commons-lang3 from 3.12.0 to 3.18.0 to mitigate CVE-2025-48924

["Sergey Nuyanzin (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/FLINK-38193?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18016872#comment-18016872 ] 

Sergey Nuyanzin edited comment on FLINK-38193 at 9/8/25 8:11 AM:
-----------------------------------------------------------------

Merged as [f4bdad4dfbfdef3d1c3d4dafd0771244dc40cb25|https://github.com/apache/flink/commit/f4bdad4dfbfdef3d1c3d4dafd0771244dc40cb25]
2.0: [427355e9b4ecb40e4e6cd1b87b32a5a20ff1d3d2|https://github.com/apache/flink/commit/427355e9b4ecb40e4e6cd1b87b32a5a20ff1d3d2]
2.1: [2af372b7361397ca501c4ec8a1f44b4ee62dc4a4|https://github.com/apache/flink/commit/2af372b7361397ca501c4ec8a1f44b4ee62dc4a4]


was (Author: sergey nuyanzin):
Merged as [f4bdad4dfbfdef3d1c3d4dafd0771244dc40cb25|https://github.com/apache/flink/commit/f4bdad4dfbfdef3d1c3d4dafd0771244dc40cb25]

> Upgrade org.apache.commons:commons-lang3 from 3.12.0 to 3.18.0 to mitigate CVE-2025-48924
> -----------------------------------------------------------------------------------------
>
>                 Key: FLINK-38193
>                 URL: https://issues.apache.org/jira/browse/FLINK-38193
>             Project: Flink
>          Issue Type: Improvement
>          Components: Connectors / Common, Connectors / FileSystem
>    Affects Versions: 2.1.0, 2.1.1
>            Reporter: Jakub Stejskal
>            Assignee: Jakub Stejskal
>            Priority: Major
>              Labels: pull-request-available
>             Fix For: 2.2.0
>
>
> Flink seems to be affected by [CVE-2025-48924|https://nvd.nist.gov/vuln/detail/CVE-2025-48924]. This should be fixable by bump commons-lang3 to 3.18 or newer.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)