Upgrade accumulo to 1.10.1 to fix CVE-2020-17533

Upgrade the accumulo version from 1.7.4 to 1.10.1 to address a security vulnerability (CVE-2020-17533). The affected library, accumulo-master, is a transitive dependency in Presto, coming from accumulo-minicluster.
prestodb · Jan 30, 2025 · 892ad68 · 892ad68
1 parent ec9e904
commit 892ad68
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/pom.xml b/pom.xml
@@ -1446,7 +1446,7 @@
             <dependency>
                 <groupId>org.apache.thrift</groupId>
                 <artifactId>libthrift</artifactId>
-                <version>0.9.3</version>
+                <version>0.9.3-1</version>
                 <exclusions>
                     <exclusion>
                         <groupId>org.apache.httpcomponents</groupId>

diff --git a/presto-accumulo/pom.xml b/presto-accumulo/pom.xml
@@ -14,7 +14,7 @@
 
     <properties>
         <air.main.basedir>${project.parent.basedir}</air.main.basedir>
-        <dep.accumulo.version>1.7.4</dep.accumulo.version>
+        <dep.accumulo.version>1.10.1</dep.accumulo.version>
         <dep.curator.version>2.12.0</dep.curator.version>
         <dep.reload4j.version>1.2.18.3</dep.reload4j.version>
     </properties>
@@ -226,7 +226,7 @@
         <dependency>
             <groupId>commons-lang</groupId>
             <artifactId>commons-lang</artifactId>
-            <version>2.4</version>
+            <version>2.6</version>
         </dependency>
 
         <dependency>