[jira] [Commented] (FLINK-24736) Non vulenerable jar files for Apache Flink 1.14.0

2021-12-22 Thread Parag Somani (Jira) 


[ 
https://issues.apache.org/jira/browse/FLINK-24736?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17464278#comment-17464278
 ] 

Parag Somani commented on FLINK-24736:
--

Updated ticket for flink 1.14.2 due to log4j vulnerability upgrade.

> Non vulenerable jar files for Apache Flink 1.14.0
> -
>
> Key: FLINK-24736
> URL: https://issues.apache.org/jira/browse/FLINK-24736
> Project: Flink
>  Issue Type: Bug
>Reporter: Parag Somani
>Priority: Major
>
> Hello,
> We are using Apache flink 1.14.0 as one of base image in our production. Due 
> to recent upgrade, we have many container security defects. 
> I am using "flink-1.14.0-bin-scala_2.12"in our k8s env.
> Please assist with Flink version having non-vulnerable libraries. List of 
> vulnerable libs are as follows: 
> [7.5] [sonatype-2020-0029] [flink-runtime] [1.14.2]
> [9.1] [CVE-2019-20445] [flink-runtime] [1.14.2]
> [9.1] [CVE-2019-20444] [flink-runtime] [1.14.2]
> [7.5] [CVE-2019-16869] [flink-runtime] [1.14.2]
> [7.5] [sonatype-2020-0029] [flink-rpc-akka] [1.14.2]
> [9.1] [CVE-2019-20445] [flink-rpc-akka] [1.14.2]
> [9.1] [CVE-2019-20444] [flink-rpc-akka] [1.14.2]
> [7.5] [CVE-2019-16869] [flink-rpc-akka] [1.14.2]
> [7.5] [sonatype-2020-0029] [flink-rpc-akka-loader] [1.14.2]
> [9.1] [CVE-2019-20445] [flink-rpc-akka-loader] [1.14.2]
> [9.1] [CVE-2019-20444] [flink-rpc-akka-loader] [1.14.2]
> [7.5] [CVE-2019-16869] [flink-rpc-akka-loader] [1.14.2]
> Can you assist with this ?



--
This message was sent by Atlassian Jira
(v8.20.1#820001)

[jira] [Commented] (FLINK-24736) Non vulenerable jar files for Apache Flink 1.14.0

2021-11-19 Thread Parag Somani (Jira) 


[ 
https://issues.apache.org/jira/browse/FLINK-24736?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=17446362#comment-17446362
 ] 

Parag Somani commented on FLINK-24736:
--

@here,

Can you assist here with upgrade of vulnerable jars? This will help to address 
security issues raised by these libs.

Thank you in advance...!

> Non vulenerable jar files for Apache Flink 1.14.0
> -
>
> Key: FLINK-24736
> URL: https://issues.apache.org/jira/browse/FLINK-24736
> Project: Flink
>  Issue Type: Bug
>Reporter: Parag Somani
>Priority: Major
>
> Hello,
> We are using Apache flink 1.14.0 as one of base image in our production. Due 
> to recent upgrade, we have many container security defects. 
> I am using "flink-1.14.0-bin-scala_2.12"in our k8s env.
> Please assist with Flink version having non-vulnerable libraries. List of 
> vulnerable libs are as follows: 
> # [7.5] [sonatype-2020-0029] [flink-rpc-akka-loader] [1.14.0]
> # [7.5] [sonatype-2019-0115] [flink-rpc-akka-loader] [1.14.0]
> # [9.1] [CVE-2019-20445] [flink-rpc-akka-loader] [1.14.0]
> # [9.1] [CVE-2019-20444] [flink-rpc-akka-loader] [1.14.0]
> # [7.5] [CVE-2019-16869] [flink-rpc-akka-loader] [1.14.0]
> # [7.5] [sonatype-2019-0115] [scala-compiler] [2.12.7]
> # [7.5] [sonatype-2019-0115] [jquery] [1.8.2]
> # [7.5] [sonatype-2020-0029] [flink-runtime] [1.14.0]
> # [7.5] [sonatype-2019-0115] [flink-runtime] [1.14.0]
> # [9.1] [CVE-2019-20445] [flink-runtime] [1.14.0]
> # [9.1] [CVE-2019-20444] [flink-runtime] [1.14.0]
> # [7.5] [CVE-2019-16869] [flink-runtime] [1.14.0]
> # [7.5] [sonatype-2020-0029] [flink-rpc-akka] [1.14.0]
> # [7.5] [sonatype-2019-0115] [flink-rpc-akka] [1.14.0]
> # [9.1] [CVE-2019-20445] [flink-rpc-akka] [1.14.0]
> # [9.1] [CVE-2019-20444] [flink-rpc-akka] [1.14.0]
> # [7.5] [CVE-2019-16869] [flink-rpc-akka] [1.14.0]
> # [9.8] [CVE-2019-17571] [log4j] [1.2.17] 
> Can you assist with this ?



--
This message was sent by Atlassian Jira
(v8.20.1#820001)