[jira] [Created] (FLINK-40206) Upgrade pulsar client to latest patch version to address critical vulnerabilities

["Nikola Stanisavljevic (Jira)" <ji...@apache.org>]

Nikola Stanisavljevic created FLINK-40206:
---------------------------------------------

             Summary: Upgrade pulsar client to latest patch version to address critical vulnerabilities
                 Key: FLINK-40206
                 URL: https://issues.apache.org/jira/browse/FLINK-40206
             Project: Flink
          Issue Type: Bug
          Components: Connectors / Pulsar
            Reporter: Nikola Stanisavljevic


pulsar-client-all dependency ships shaded copies of libraries which have two Critical-severity CVEs: 
 * [CVE-2023-39410|https://github.com/advisories/GHSA-r7pg-v2c8-mfg3]- avro
 * [CVE-2024-53990|https://github.com/advisories/GHSA-mfj5-cf8g-g2fv]- async-http-client


Simply forcing resolution to latest patch version of pulsar-client-all does not work, because connector is using _PulsarClientImpl.getPartitionedTopicMetadata(String)_ directly instead of going through the public PulsarClient. Pathed version does not have this method signature in {_}PulsarClientImpl{_}, thus connector raises _java.lang.NoSuchMethodError_
*Solution:*
 * Use public interface of _PulsarClient_ instead of _PulsarClientImpl_
 * Update pulsar-client-all to latest patch version

 



--
This message was sent by Atlassian Jira
(v8.20.10#820010)