[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[jira] [Created] (FLINK-10303) Fix critical vulnerabilities Python API

Konstantin Knauf created FLINK-10303:

             Summary: Fix critical vulnerabilities Python API
                 Key: FLINK-10303
                 URL: https://issues.apache.org/jira/browse/FLINK-10303
             Project: Flink
          Issue Type: Improvement
          Components: Python API
    Affects Versions: 1.6.0
            Reporter: Konstantin Knauf

A user has reported two "critical" vulnerabilities in the Python API, which we should probably fix: 

* https://nvd.nist.gov/vuln/detail/CVE-2016-4000
* https://cwe.mitre.org/data/definitions/384.html in flink-streaming-python_2.11-1.6.0.jar <= pip-1.6-py2.py3-none-any.whl <= sessions.py : [2.1.0, 2.6.0)

For users, who don't need the Python API, an easy work-around is exclude the flink-streaming-python_2.11.jar from the distribution. 

This message was sent by Atlassian JIRA