[fix][sec] Upgrade Avro to 1.11.4 to address CVE-2024-47561 (#23394)

apache · Oct 4, 2024 · fd7e0b4 · fd7e0b4
1 parent c089aff
commit fd7e0b4
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 5 deletions.
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -494,8 +494,8 @@ The Apache Software License, Version 2.0
   * zt-zip
     - org.zeroturnaround-zt-zip-1.17.jar
   * Apache Avro
-    - org.apache.avro-avro-1.11.3.jar
-    - org.apache.avro-avro-protobuf-1.11.3.jar
+    - org.apache.avro-avro-1.11.4.jar
+    - org.apache.avro-avro-protobuf-1.11.4.jar
   * Apache Curator
     - org.apache.curator-curator-client-5.1.0.jar
     - org.apache.curator-curator-framework-5.1.0.jar

diff --git a/pom.xml b/pom.xml
@@ -146,7 +146,7 @@ flexible messaging model and an intuitive client API.</description>
     <kafka-client.version>2.7.2</kafka-client.version>
     <rabbitmq-client.version>5.1.1</rabbitmq-client.version>
     <aws-sdk.version>1.12.262</aws-sdk.version>
-    <avro.version>1.11.3</avro.version>
+    <avro.version>1.11.4</avro.version>
     <joda.version>2.10.5</joda.version>
     <jclouds.version>2.5.0</jclouds.version>
     <guice.version>5.1.0</guice.version>

diff --git a/pulsar-sql/presto-distribution/LICENSE b/pulsar-sql/presto-distribution/LICENSE
@@ -381,8 +381,8 @@ The Apache Software License, Version 2.0
   * Apache XBean :: Reflect
     - xbean-reflect-3.4.jar
   * Avro
-    - avro-1.11.3.jar
-    - avro-protobuf-1.11.3.jar
+    - avro-1.11.4.jar
+    - avro-protobuf-1.11.4.jar
   * Caffeine
     - caffeine-2.9.1.jar
   * Javax