[
https://issues.apache.org/jira/browse/FLINK-40243?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siddharth R updated FLINK-40243:
--------------------------------
Description:
*Description:*
Bump derby and postgresql JDBC driver versions to address known CVEs.
Both dependencies are declared <scope>test</scope> and are not bundled
in any release artifact.
*Derby:*
[CVE-2022-46337|https://nvd.nist.gov/vuln/detail/cve-2022-46337] - LDAP
authentication bypass (CVSS 9.8)
Current - org.apache.derby » derby » 10.15.2.0
Latest - org.apache.derby » derby » 10.17.1.0
*PostgreSQL JDBC driver:*
[CVE-2026-42198|https://nvd.nist.gov/vuln/detail/CVE-2026-42198] -
SCRAM-SHA-256 iteration-count DoS (CVSS 7.5 HIGH)
Current - org.postgresql » postgresql » 42.5.6
Latest - org.postgresql » postgresql » 42.7.13
was:
The current version 42.5.6 has a direct vulnerability -
[*CVE-2026-42198*|https://nvd.nist.gov/vuln/detail/CVE-2026-42198] (CVSS 7.5
HIGH).
{*}Vulnerability{*}: A malicious server can instruct the PostgreSQL JDBC driver
to
perform SCRAM-SHA-256 authentication with a very large iteration count, causing
the client to exhaust CPU resources — effectively a denial-of-service against
the connection pool.
{*}Affected versions{*}: 42.2.0 through 42.7.10
*Fixed* {*}in{*}: 42.7.11
*Current* - Maven Repository: org.postgresql » postgresql » 42.5.6
*Latest* - Maven Repository: org.postgresql » postgresql » 42.7.13
Summary: Bump JDBC test dependencies: derby 10.15.2.0→10.17.1.0,
postgresql 42.5.6→42.7.13 (was: Bump postgresql jdbc driver from 42.5.6 to
42.7.13)
> Bump JDBC test dependencies: derby 10.15.2.0→10.17.1.0, postgresql
> 42.5.6→42.7.13
> ---------------------------------------------------------------------------------
>
> Key: FLINK-40243
> URL: https://issues.apache.org/jira/browse/FLINK-40243
> Project: Flink
> Issue Type: Improvement
> Components: Autoscaler, Tests
> Reporter: Siddharth R
> Priority: Minor
> Labels: pull-request-available
>
> *Description:*
> Bump derby and postgresql JDBC driver versions to address known CVEs.
> Both dependencies are declared <scope>test</scope> and are not bundled
> in any release artifact.
> *Derby:*
> [CVE-2022-46337|https://nvd.nist.gov/vuln/detail/cve-2022-46337] - LDAP
> authentication bypass (CVSS 9.8)
> Current - org.apache.derby » derby » 10.15.2.0
> Latest - org.apache.derby » derby » 10.17.1.0
> *PostgreSQL JDBC driver:*
> [CVE-2026-42198|https://nvd.nist.gov/vuln/detail/CVE-2026-42198] -
> SCRAM-SHA-256 iteration-count DoS (CVSS 7.5 HIGH)
> Current - org.postgresql » postgresql » 42.5.6
> Latest - org.postgresql » postgresql » 42.7.13
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
