[FLINK-14121] Update commons-compress because of CVE-2019-12402

This closes apache#11333.

flink-dist/src/main/resources/META-INF/NOTICE

@@ -19,7 +19,7 @@ This project bundles the following dependencies under the Apache Software Licens
 - commons-cli:commons-cli:1.3.1
 - commons-collections:commons-collections:3.2.2
 - commons-io:commons-io:2.4
-- org.apache.commons:commons-compress:1.18
+- org.apache.commons:commons-compress:1.20
 - org.apache.commons:commons-lang3:3.3.2
 - org.apache.commons:commons-math3:3.5
 - org.javassist:javassist:3.24.0-GA

flink-filesystems/flink-oss-fs-hadoop/src/main/resources/META-INF/NOTICE

@@ -30,7 +30,7 @@ This project bundles the following dependencies under the Apache Software Licens
 - net.minidev:accessors-smart:1.2
 - net.minidev:json-smart:2.3
 - org.apache.avro:avro:1.8.2
-- org.apache.commons:commons-compress:1.18
+- org.apache.commons:commons-compress:1.20
 - org.apache.commons:commons-configuration2:2.1.1
 - org.apache.commons:commons-lang3:3.3.2
 - org.apache.commons:commons-math3:3.5

flink-filesystems/flink-swift-fs-hadoop/src/main/resources/META-INF/NOTICE

@@ -16,7 +16,7 @@ This project bundles the following dependencies under the Apache Software Licens
 - org.apache.htrace:htrace-core4:4.0.1-incubating
 - org.apache.httpcomponents:httpclient:4.5.3
 - org.apache.httpcomponents:httpcore:4.4.6
-- org.apache.commons:commons-compress:1.18
+- org.apache.commons:commons-compress:1.20
 - org.apache.commons:commons-math3:3.5
 - commons-beanutils:commons-beanutils:1.8.3
 - commons-cli:commons-cli:1.3.1

pom.xml

@@ -538,7 +538,7 @@ under the License.
 			<dependency>
 				<groupId>org.apache.commons</groupId>
 				<artifactId>commons-compress</artifactId>
-				<version>1.18</version>
+				<version>1.20</version>
 			</dependency>
 
 			<!-- Managed dependency required for HBase in flink-hbase -->