[
https://issues.apache.org/jira/browse/FLINK-19929?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17327568#comment-17327568
]
Flink Jira Bot commented on FLINK-19929:
----------------------------------------
This major issue is unassigned and itself and all of its Sub-Tasks have not
been updated for 30 days. So, it has been labeled "stale-major". If this ticket
is indeed "major", please either assign yourself or give an update. Afterwards,
please remove the label. In 7 days the issue will be deprioritized.
> Upgrade Kinesis dependencies to avoid protobuf 2.6.1
> ----------------------------------------------------
>
> Key: FLINK-19929
> URL: https://issues.apache.org/jira/browse/FLINK-19929
> Project: Flink
> Issue Type: Improvement
> Components: Connectors / Kinesis
> Reporter: Chesnay Schepler
> Priority: Major
> Labels: stale-major
> Fix For: 1.13.0
>
>
> Our current Kinesis dependencies (amazon-kinesis-client,
> amazon-kinesis-producer) depend on protobuf 2.6.1, which are affected by
> [CVE-2015-5237|https://nvd.nist.gov/vuln/detail/CVE-2015-5237].
> We should look into upgrade the client to 1.14.0, and the producer to 0.14.1 .
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
