[
https://issues.apache.org/jira/browse/FLINK-40206?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Nikola Stanisavljevic updated FLINK-40206:
------------------------------------------
Summary: Upgrade pulsar-client to 3.0.17 to address critical
vulnerabilities (was: Upgrade pulsar client to latest patch version to address
critical vulnerabilities)
> Upgrade pulsar-client to 3.0.17 to address critical vulnerabilities
> -------------------------------------------------------------------
>
> Key: FLINK-40206
> URL: https://issues.apache.org/jira/browse/FLINK-40206
> Project: Flink
> Issue Type: Bug
> Components: Connectors / Pulsar
> Reporter: Nikola Stanisavljevic
> Priority: Major
>
> pulsar-client-all dependency ships shaded copies of libraries which have two
> Critical-severity CVEs:
> * [CVE-2023-39410|https://github.com/advisories/GHSA-r7pg-v2c8-mfg3]- avro
> * [CVE-2024-53990|https://github.com/advisories/GHSA-mfj5-cf8g-g2fv]-
> async-http-client
> Simply forcing resolution to latest patch version of pulsar-client-all does
> not work, because connector is using
> _PulsarClientImpl.getPartitionedTopicMetadata(String)_ directly instead of
> going through the public PulsarClient. Pathed version does not have this
> method signature in {_}PulsarClientImpl{_}, thus connector raises
> _java.lang.NoSuchMethodError_
> *Solution:*
> * Use public interface of _PulsarClient_ instead of _PulsarClientImpl_
> * Update pulsar-client-all to latest patch version
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
