[
https://issues.apache.org/jira/browse/FLINK-39139?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18061033#comment-18061033
]
Rui Fan edited comment on FLINK-39139 at 2/25/26 1:17 PM:
----------------------------------------------------------
Merged to
* master 2.3.0 via: e9afe8bfc52fdd9b94193e789ca1b4ed73099560
* 2.2.1 via: 88a10d984d60cf03cb94a7fcd754fd5398e4fb4d
* 2.1.2 via: 7beaca7c2e70e92edb1ffc40079c0df1216ec9c4
* 1.20.4 via: d11d8d86b20712950991718ca1a03f993f577d88
was (Author: fanrui):
Merged to
* master 2.3.0 via: e9afe8bfc52fdd9b94193e789ca1b4ed73099560
* 2.2.1 via: 88a10d984d60cf03cb94a7fcd754fd5398e4fb4d
* 2.1.2 via: 7beaca7c2e70e92edb1ffc40079c0df1216ec9c4
* 1.20 via: d11d8d86b20712950991718ca1a03f993f577d88
> Update lz4-java to 1.10.3
> -------------------------
>
> Key: FLINK-39139
> URL: https://issues.apache.org/jira/browse/FLINK-39139
> Project: Flink
> Issue Type: Improvement
> Reporter: Cameron
> Assignee: Cameron
> Priority: Major
> Labels: pull-request-available
> Fix For: 1.20.4, 2.1.2, 2.3.0, 2.2.1
>
>
> lz4-java 1.8.0 has the following CVEs:
> * [CVE-2025-66566|https://www.cve.org/CVERecord?id=CVE-2025-66566]
> * [CVE-2025-12183|https://www.cve.org/CVERecord?id=CVE-2025-12183]
> Updating lz4-java to 1.10.3 resolves the CVE
> It has also been relocated to at.yawk.lz4
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
