You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@flink.apache.org by "Martijn Visser (Jira)" <ji...@apache.org> on 2024/10/25 14:26:00 UTC

[jira] [Closed] (FLINK-36593) Upgrade io.airlift:aircompressor to mitigate CVE

     [ https://issues.apache.org/jira/browse/FLINK-36593?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Martijn Visser closed FLINK-36593.
----------------------------------
    Fix Version/s: 2.0.0
         Assignee: Thomas Cooper
       Resolution: Fixed

Fixed in apache/master aaa8ad48f8e0fa7876d92068517d8a648133c91e

> Upgrade io.airlift:aircompressor to mitigate CVE
> ------------------------------------------------
>
>                 Key: FLINK-36593
>                 URL: https://issues.apache.org/jira/browse/FLINK-36593
>             Project: Flink
>          Issue Type: Improvement
>          Components: API / Core
>    Affects Versions: 2.0-preview
>            Reporter: Thomas Cooper
>            Assignee: Thomas Cooper
>            Priority: Major
>              Labels: pull-request-available
>             Fix For: 2.0.0
>
>
> The current version of the aircompressor library (0.21), used in the flink-runtime module, has a vulnerability: [CVE-2024-36114|https://nvd.nist.gov/vuln/detail/CVE-2024-36114].
> This can be mitigated by upgrading to version 0.27 of the library.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)