cherry-pick spark3.2 KE commit 289884d

KE-42144 & KE-42145 Fix vulnerabilities, upgrade tomcat-embed-core & netty (apache#638) * KE-42144 Upgrade tomcat-embed-core to 9.0.76 * KE-42145 Upgrade netty-handler to 4.1.94.Final
RolatZhang · Aug 21, 2023 · 65c0608 · 65c0608
1 parent b9f98f9
commit 65c0608
Show file tree

Hide file tree

Showing 3 changed files with 21 additions and 2 deletions.
diff --git a/external/kafka-0-10-sql/pom.xml b/external/kafka-0-10-sql/pom.xml
@@ -130,6 +130,12 @@
       <artifactId>zookeeper</artifactId>
       <version>3.5.7</version>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>io.netty</groupId>
+          <artifactId>netty-handler</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>net.sf.jopt-simple</groupId>

diff --git a/external/kafka-0-10/pom.xml b/external/kafka-0-10/pom.xml
@@ -102,6 +102,12 @@
       <artifactId>zookeeper</artifactId>
       <version>3.5.7</version>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>io.netty</groupId>
+          <artifactId>netty-handler</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>net.sf.jopt-simple</groupId>

diff --git a/pom.xml b/pom.xml
@@ -204,7 +204,9 @@
     <bouncycastle.version>1.60</bouncycastle.version>
     <tink.version>1.6.1</tink.version>
     <tomcat.version>9.0.68</tomcat.version>
-    <tomcat-embed-core.version>9.0.72</tomcat-embed-core.version>
+    <tomcat-embed-core.version>9.0.76</tomcat-embed-core.version>
+    <netty.version>4.1.89.Final</netty.version>
+    <netty-handler.version>4.1.94.Final</netty-handler.version>
     <!--
     If you are changing Arrow version specification, please check
     ./python/pyspark/sql/pandas/utils.py, and ./python/setup.py too.
@@ -807,7 +809,7 @@
       <dependency>
         <groupId>io.netty</groupId>
         <artifactId>netty-all</artifactId>
-        <version>4.1.89.Final</version>
+        <version>${netty.version}</version>
         <exclusions>
           <exclusion>
             <groupId>io.netty</groupId>
@@ -883,6 +885,11 @@
           </exclusion>
         </exclusions>
       </dependency>
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-handler</artifactId>
+        <version>${netty-handler.version}</version>
+      </dependency>
       <dependency>
         <groupId>org.apache.derby</groupId>
         <artifactId>derby</artifactId>