Skip to content

Commit

Permalink
[security] Upgrade Postgre driver to 42.2.25 to get rid of CVE-2022-2…
Browse files Browse the repository at this point in the history
…1724 (apache#14119)

### Motivation

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-21724

### Modifications

Upgrade both `jdbc` and `debezium` Postgre java driver dependency to 42.2.25 (from 42.2.24 and 42.2.22).
Note: the version is not shared on purpose because we should leave the driver dependencies separated since the two connectors are used in different ways. (For example, when we'll upgrade Debezium to 1.8.x we'll need to remove the override and keep the 42.3.x version)

For cherry-picks, branch-2.9 and branch-2.8 are compatible since:
* branch-2.9 has the same debezium version
* branch-2.8 has 1.0.0 but it uses [pg driver 42.2.x](https://search.maven.org/artifact/io.debezium/debezium-parent/1.0.0.Final/pom) as well 

### Documentation

- [x] `no-need-doc`
  • Loading branch information
nicoloboschi authored Feb 7, 2022
1 parent bea5bb8 commit 6481845
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 1 deletion.
3 changes: 2 additions & 1 deletion pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -149,7 +149,7 @@ flexible messaging model and an intuitive client API.</description>
<guice.version>5.0.1</guice.version>
<sqlite-jdbc.version>3.8.11.2</sqlite-jdbc.version>
<mysql-jdbc.version>8.0.11</mysql-jdbc.version>
<postgresql-jdbc.version>42.2.24</postgresql-jdbc.version>
<postgresql-jdbc.version>42.2.25</postgresql-jdbc.version>
<clickhouse-jdbc.version>0.3.2</clickhouse-jdbc.version>
<mariadb-jdbc.version>2.6.0</mariadb-jdbc.version>
<hdfs-offload-version3>3.3.1</hdfs-offload-version3>
Expand All @@ -159,6 +159,7 @@ flexible messaging model and an intuitive client API.</description>
<scala.binary.version>2.13</scala.binary.version>
<scala-library.version>2.13.6</scala-library.version>
<debezium.version>1.7.2.Final</debezium.version>
<debezium.postgresql.version>42.2.25</debezium.postgresql.version>
<jsonwebtoken.version>0.11.1</jsonwebtoken.version>
<opencensus.version>0.18.0</opencensus.version>
<hbase.version>2.4.9</hbase.version>
Expand Down
7 changes: 7 additions & 0 deletions pulsar-io/debezium/postgres/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,13 @@
<version>${debezium.version}</version>
</dependency>

<dependency>
<groupId>org.postgresql</groupId>
<artifactId>postgresql</artifactId>
<version>${debezium.postgresql.version}</version>
<scope>runtime</scope>
</dependency>

</dependencies>

<build>
Expand Down

0 comments on commit 6481845

Please sign in to comment.