You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@flink.apache.org by "Chesnay Schepler (Jira)" <ji...@apache.org> on 2020/11/02 13:08:01 UTC

[jira] [Created] (FLINK-19929) Upgrade Kinesis dependencies to avoid protobuf 2.6.1

Chesnay Schepler created FLINK-19929:
----------------------------------------

             Summary: Upgrade Kinesis dependencies to avoid protobuf 2.6.1
                 Key: FLINK-19929
                 URL: https://issues.apache.org/jira/browse/FLINK-19929
             Project: Flink
          Issue Type: Improvement
          Components: Connectors / Kinesis
            Reporter: Chesnay Schepler
             Fix For: 1.13.0


Our current Kinesis dependencies (amazon-kinesis-client, amazon-kinesis-producer) depend on protobuf 2.6.1, which are affected by [CVE-2015-5237|https://nvd.nist.gov/vuln/detail/CVE-2015-5237].

We should look into upgrade the client to 1.14.0, and the producer to 0.14.1 .



--
This message was sent by Atlassian Jira
(v8.3.4#803005)