You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@flink.apache.org by "Chesnay Schepler (Jira)" <ji...@apache.org> on 2020/03/25 10:33:00 UTC
[jira] [Created] (FLINK-16772) Bump derby to 10.12.1.1+ or exclude
it
Chesnay Schepler created FLINK-16772:
----------------------------------------
Summary: Bump derby to 10.12.1.1+ or exclude it
Key: FLINK-16772
URL: https://issues.apache.org/jira/browse/FLINK-16772
Project: Flink
Issue Type: Improvement
Components: Connectors / Hive
Affects Versions: 1.10.0
Reporter: Chesnay Schepler
Fix For: 1.10.1, 1.11.0
{{hive-metastore}} depends on derby 10.10/10.4, which are vulnerable to [CVE-2015-1832|https://nvd.nist.gov/vuln/detail/CVE-2015-1832].
We should bump the version to at least 10.12.1.1 .
Assuming that derby is only required for the server and not the client we could potentially even exclude it.
[~phoenixjiangnan] Can you help with this?
--
This message was sent by Atlassian Jira
(v8.3.4#803005)