This is an automated email from the ASF dual-hosted git repository. penghui pushed a commit to branch branch-2.8 in repository https://gitbox.apache.org/repos/asf/pulsar.git
commit 4b194327cdd2b3154491f5557a990041d9ca5aa0 Author: Lari Hotari <[email protected]> AuthorDate: Tue Jan 11 07:56:15 2022 +0200 [Security] Upgrade protobuf to 3.16.1 to address CVE-2021-22569 (#13695) ### Motivation - protobuf < 3.16.1 contains DoS vulnerability CVE-2021-22569, https://nvd.nist.gov/vuln/detail/CVE-2021-22569. ### Modifications - upgrade protobuf from 3.11.4 to 3.16.1 (cherry picked from commit 1a3688c936bb2320db34ccfbef08500f2c522591) --- distribution/server/src/assemble/LICENSE.bin.txt | 4 ++-- pom.xml | 2 +- pulsar-sql/presto-distribution/LICENSE | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt index f5684e9..0c50f4c 100644 --- a/distribution/server/src/assemble/LICENSE.bin.txt +++ b/distribution/server/src/assemble/LICENSE.bin.txt @@ -543,8 +543,8 @@ MIT License Protocol Buffers License * Protocol Buffers - - com.google.protobuf-protobuf-java-3.11.4.jar -- licenses/LICENSE-protobuf.txt - - com.google.protobuf-protobuf-java-util-3.11.4.jar -- licenses/LICENSE-protobuf.txt + - com.google.protobuf-protobuf-java-3.16.1.jar -- licenses/LICENSE-protobuf.txt + - com.google.protobuf-protobuf-java-util-3.16.1.jar -- licenses/LICENSE-protobuf.txt CDDL-1.1 -- licenses/LICENSE-CDDL-1.1.txt * Java Annotations API diff --git a/pom.xml b/pom.xml index 8bafc50..84355ed 100644 --- a/pom.xml +++ b/pom.xml @@ -129,7 +129,7 @@ flexible messaging model and an intuitive client API.</description> <puppycrawl.checkstyle.version>8.37</puppycrawl.checkstyle.version> <dockerfile-maven.version>1.4.13</dockerfile-maven.version> <typetools.version>0.5.0</typetools.version> - <protobuf3.version>3.11.4</protobuf3.version> + <protobuf3.version>3.16.1</protobuf3.version> <protoc3.version>${protobuf3.version}</protoc3.version> <grpc.version>1.33.0</grpc.version> <perfmark.version>0.19.0</perfmark.version> diff --git a/pulsar-sql/presto-distribution/LICENSE b/pulsar-sql/presto-distribution/LICENSE index 0fa9952..9062e45 100644 --- a/pulsar-sql/presto-distribution/LICENSE +++ b/pulsar-sql/presto-distribution/LICENSE @@ -459,7 +459,7 @@ The Apache Software License, Version 2.0 Protocol Buffers License * Protocol Buffers - - protobuf-java-3.11.4.jar + - protobuf-java-3.16.1.jar BSD 3-clause "New" or "Revised" License * RE2J TD -- re2j-td-1.4.jar
