[jira] [Comment Edited] (FLINK-10303) Fix critical vulnerabilities Python API

["Chesnay Schepler (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/FLINK-10303?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16607937#comment-16607937 ] 

Chesnay Schepler edited comment on FLINK-10303 at 9/8/18 7:15 AM:
------------------------------------------------------------------

How can I verify that bumping the version to 2.7.1 is not adding more security vulnerabilities? i.e., how was this detected?


was (Author: zentol):
How can I verify that bumping the version to 2.7.1 is not adding more security vulnerabilities?

> Fix critical vulnerabilities Python API
> ---------------------------------------
>
>                 Key: FLINK-10303
>                 URL: https://issues.apache.org/jira/browse/FLINK-10303
>             Project: Flink
>          Issue Type: Improvement
>          Components: Python API
>    Affects Versions: 1.6.0
>            Reporter: Konstantin Knauf
>            Priority: Major
>
> A user has reported two "critical" vulnerabilities in the Python API, which we should probably fix: 
> * https://nvd.nist.gov/vuln/detail/CVE-2016-4000
> * https://cwe.mitre.org/data/definitions/384.html in flink-streaming-python_2.11-1.6.0.jar <= pip-1.6-py2.py3-none-any.whl <= sessions.py : [2.1.0, 2.6.0)
> For users, who don't need the Python API, an easy work-around is exclude the flink-streaming-python_2.11.jar from the distribution. 
>  



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)