[
https://issues.apache.org/jira/browse/FLINK-40243?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18099632#comment-18099632
]
Siddharth R commented on FLINK-40243:
-------------------------------------
[~psinha] just added the components as well :)
> Bump postgresql jdbc driver from 42.5.6 to 42.7.13
> --------------------------------------------------
>
> Key: FLINK-40243
> URL: https://issues.apache.org/jira/browse/FLINK-40243
> Project: Flink
> Issue Type: Improvement
> Components: Autoscaler, Tests
> Reporter: Siddharth R
> Priority: Minor
> Labels: pull-request-available
>
> The current version 42.5.6 has a direct vulnerability -
> [*CVE-2026-42198*|https://nvd.nist.gov/vuln/detail/CVE-2026-42198] (CVSS 7.5
> HIGH).
> {*}Vulnerability{*}: A malicious server can instruct the PostgreSQL JDBC
> driver to
> perform SCRAM-SHA-256 authentication with a very large iteration count,
> causing
> the client to exhaust CPU resources — effectively a denial-of-service against
> the connection pool.
> {*}Affected versions{*}: 42.2.0 through 42.7.10
> *Fixed* {*}in{*}: 42.7.11
> *Current* - Maven Repository: org.postgresql » postgresql » 42.5.6
> *Latest* - Maven Repository: org.postgresql » postgresql » 42.7.13
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
