[
https://issues.apache.org/jira/browse/KAFKA-21174?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ken Huang updated KAFKA-21174:
------------------------------
Fix Version/s: 4.3.2
> Update lz4 to 1.11.4
> --------------------
>
> Key: KAFKA-21174
> URL: https://issues.apache.org/jira/browse/KAFKA-21174
> Project: Kafka
> Issue Type: Task
> Reporter: Gergely Harmadás
> Assignee: Gergely Harmadás
> Priority: Minor
> Fix For: 4.3.2, 4.5.0
>
>
> [https://github.com/yawkat/lz4-java/releases/tag/v1.11.4]
> Fixes
> [GHSA-gm45-99xc-r7wv|https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv],
>
> [GHSA-343h-94h5-c4wr|https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr]
> and
> [GHSA-mcr4-qmvw-px4g|https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g]
> Note that there is also a
> [1.12.0|https://github.com/yawkat/lz4-java/releases/tag/v1.12.0] release but
> but based on the description it might contain breaking changes without
> additional security patches. Needs further investigation maybe in a separate
> ticket and the current Jira can handle the immediate CVE fix
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
