This is an automated email from the ASF dual-hosted git repository.
penghui pushed a commit to branch branch-2.7
in repository https://gitbox.apache.org/repos/asf/pulsar.git
The following commit(s) were added to refs/heads/branch-2.7 by this push:
new f380c87 [Security] Upgrade protobuf to 3.16.1 to address
CVE-2021-22569 (#13695)
f380c87 is described below
commit f380c87a53982e45fc8ee4c4bfea064cf8c472f2
Author: Lari Hotari <[email protected]>
AuthorDate: Tue Jan 11 07:56:15 2022 +0200
[Security] Upgrade protobuf to 3.16.1 to address CVE-2021-22569 (#13695)
- protobuf < 3.16.1 contains DoS vulnerability CVE-2021-22569,
https://nvd.nist.gov/vuln/detail/CVE-2021-22569.
- upgrade protobuf from 3.11.4 to 3.16.1
(cherry picked from commit 1a3688c936bb2320db34ccfbef08500f2c522591)
---
distribution/server/src/assemble/LICENSE.bin.txt | 4 ++--
pom.xml | 2 +-
pulsar-sql/presto-distribution/LICENSE | 4 ++--
3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt
b/distribution/server/src/assemble/LICENSE.bin.txt
index 8e8f242..9356988 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -537,8 +537,8 @@ MIT License
Protocol Buffers License
* Protocol Buffers
- - com.google.protobuf-protobuf-java-3.11.4.jar --
licenses/LICENSE-protobuf.txt
- - com.google.protobuf-protobuf-java-util-3.11.4.jar --
licenses/LICENSE-protobuf.txt
+ - com.google.protobuf-protobuf-java-3.16.1.jar --
licenses/LICENSE-protobuf.txt
+ - com.google.protobuf-protobuf-java-util-3.16.1.jar --
licenses/LICENSE-protobuf.txt
- com.google.protobuf.nano-protobuf-javanano-3.0.0-alpha-5.jar --
licenses/LICENSE-protobuf.txt
CDDL-1.1 -- licenses/LICENSE-CDDL-1.1.txt
diff --git a/pom.xml b/pom.xml
index 2a947ab5..aee8f00 100644
--- a/pom.xml
+++ b/pom.xml
@@ -122,7 +122,7 @@ flexible messaging model and an intuitive client
API.</description>
<dockerfile-maven.version>1.4.13</dockerfile-maven.version>
<typetools.version>0.5.0</typetools.version>
<protobuf2.version>2.4.1</protobuf2.version>
- <protobuf3.version>3.11.4</protobuf3.version>
+ <protobuf3.version>3.16.1</protobuf3.version>
<protoc3.version>${protobuf3.version}</protoc3.version>
<grpc.version>1.18.0</grpc.version>
<protoc-gen-grpc-java.version>${grpc.version}</protoc-gen-grpc-java.version>
diff --git a/pulsar-sql/presto-distribution/LICENSE
b/pulsar-sql/presto-distribution/LICENSE
index 5309374..fcc8ee4 100644
--- a/pulsar-sql/presto-distribution/LICENSE
+++ b/pulsar-sql/presto-distribution/LICENSE
@@ -465,8 +465,8 @@ The Apache Software License, Version 2.0
Protocol Buffers License
* Protocol Buffers
- protobuf-shaded-2.1.0-incubating.jar
- - protobuf-java-3.11.4.jar
- - protobuf-java-util-3.11.4.jar
+ - protobuf-java-3.16.1.jar
+ - protobuf-java-util-3.16.1.jar
BSD 3-clause "New" or "Revised" License
* RE2J TD -- re2j-td-1.4.jar
