fix(cve): 修复 CVE-2026-35194 在 flink 中的漏洞-flink-AtomGit

已开启

fix(cve): 修复 CVE-2026-35194 在 flink 中的漏洞 #73

infra_team创建于 5月18日从infra_team/flink： fix-CVE-2026-35194-master 合入到 src-openeuler/flink： master

fix(cve): 修复 CVE-2026-35194 在 flink 中的漏洞 #73

已开启

infra_team创建于 5月18日

从infra_team/flink fix-CVE-2026-35194-master合入到src-openeuler/flink master

共 6 个文件变更+31-54

M0001-add-npm.hw-repo.patch+14-13

	@@ -1,27 +1,28 @@
1	-diff -Naur flink-release-1.17.1/flink-runtime-web/pom.xml flink-release-1.17.1-change/flink-runtime-web/pom.xml	1	+--- flink-release-1.20.4/flink-runtime-web/pom.xml 2026-04-17 04:34:59.000000000 +0800
2	---- flink-release-1.17.1/flink-runtime-web/pom.xml 2023-05-19 16:45:46.000000000 +0800	2	++++ flink-release-1.20.4-modified/flink-runtime-web/pom.xml 2026-05-18 02:29:33.141203714 +0800
3	-+++ flink-release-1.17.1-change/flink-runtime-web/pom.xml 2023-09-27 14:16:02.741215322 +0800	3	+@@ -264,7 +264,9 @@
4	-@@ -259,6 +259,7 @@
5	</goals>	4	</goals>
6	<configuration>	5	<configuration>
7	- <nodeVersion>v16.13.2</nodeVersion>	6	+ <nodeVersion>v22.16.0</nodeVersion>
8	-+ <downloadRoot>https://repo.huaweicloud.com/nodejs/</downloadRoot>	7	++ <nodeDownloadRoot>https://repo.huaweicloud.com/nodejs/</nodeDownloadRoot>
9	- <npmVersion>8.1.2</npmVersion>	8	+ <npmVersion>10.9.0</npmVersion>
		9	++ <npmDownloadRoot>https://mirrors.huaweicloud.com/repository/npm/npm/-/</npmDownloadRoot>
10	</configuration>	10	</configuration>
11	</execution>	11	</execution>
12	-@@ -269,6 +270,7 @@	12	+ <execution>
		13	+@@ -273,6 +275,7 @@
		14	+ <goal>npm</goal>
13	</goals>	15	</goals>
14	<configuration>	16	<configuration>
15	- <arguments>ci --cache-max=0 --no-save ${npm.proxy}</arguments>
16	+ <npmRegistryURL>https://repo.huaweicloud.com/repository/npm</npmRegistryURL>	17	+ <npmRegistryURL>https://repo.huaweicloud.com/repository/npm</npmRegistryURL>
		18	+ <arguments>ci --cache-max=0 --no-save ${npm.proxy}</arguments>
17	<environmentVariables>	19	<environmentVariables>
18	<HUSKY_SKIP_INSTALL>true</HUSKY_SKIP_INSTALL>	20	<HUSKY_SKIP_INSTALL>true</HUSKY_SKIP_INSTALL>
19	- </environmentVariables>	21	+@@ -285,6 +288,7 @@
20	-@@ -281,6 +283,7 @@	22	+ <goal>npm</goal>
21	</goals>	23	</goals>
22	<configuration>	24	<configuration>
23	- <arguments>run ci-check</arguments>
24	+ <npmRegistryURL>https://repo.huaweicloud.com/repository/npm</npmRegistryURL>	25	+ <npmRegistryURL>https://repo.huaweicloud.com/repository/npm</npmRegistryURL>
		26	+ <arguments>run ci-check</arguments>
25	</configuration>	27	</configuration>
26	</execution>	28	</execution>
27	- </executions>

D0002-fix-compilation-failure.patch+0-14

	@@ -1,14 +0,0 @@
1	---- flink-release-1.17.1/flink-end-to-end-tests/flink-end-to-end-tests-common-kafka/pom.xml 2023-05-19 16:45:46.000000000 +0800
2	-+++ flink-release-1.17.1-change/flink-end-to-end-tests/flink-end-to-end-tests-common-kafka/pom.xml 2023-09-26 17:25:33.739542538 +0800
3	-@@ -43,6 +43,11 @@
4	- <artifactId>flink-end-to-end-tests-common</artifactId>
5	- <version>${project.version}</version>
6	- </dependency>
7	-+ <dependency>
8	-+ <groupId>io.confluent</groupId>
9	-+ <artifactId>kafka-schema-serializer</artifactId>
10	-+ <version>7.2.2</version>
11	-+ </dependency>
12	- <dependency>
13	- <groupId>org.apache.flink</groupId>
14	- <artifactId>flink-connector-kafka</artifactId>

M0003-Skip-flink-avro-confluent-registry-test.patch+7-6

	@@ -1,10 +1,11 @@
1	-diff -Naur flink-release-1.17.1/flink-formats/flink-avro-confluent-registry/pom.xml flink-release-1.17.1-change/flink-formats/flink-avro-confluent-registry/pom.xml	1	+--- flink-release-1.20.4-orig/flink-formats/flink-avro-confluent-registry/pom.xml 2026-04-17 04:34:59.000000000 +0800
2	---- flink-release-1.17.1/flink-formats/flink-avro-confluent-registry/pom.xml 2023-05-19 16:45:46.000000000 +0800	2	++++ flink-release-1.20.4/flink-formats/flink-avro-confluent-registry/pom.xml 2026-05-18 03:03:11.362372587 +0800
3	-+++ flink-release-1.17.1-change/flink-formats/flink-avro-confluent-registry/pom.xml 2023-09-25 17:26:23.465127239 +0800	3	+@@ -32,7 +32,8 @@
4	-@@ -34,6 +34,7 @@	4	+ <name>Flink : Formats : Avro confluent registry</name>
		5	+
5	<properties>	6	<properties>
6	- <kafka.version>3.2.3</kafka.version>	7	+- <confluent.version>7.5.3</confluent.version>
7	- <confluent.version>7.2.2</confluent.version>	8	++ <confluent.version>7.2.2</confluent.version>
8	+ <maven.test.skip>true</maven.test.skip>	9	+ <maven.test.skip>true</maven.test.skip>
9	</properties>	10	</properties>
10		11

D0004-update-npm.hw-repo.patch+0-13

	@@ -1,13 +0,0 @@
1	---- flink-release-1.17.1/flink-runtime-web/pom.xml 2024-04-24 10:45:59.360106215 +0800
2	-+++ flink-release-1.17.1-change/flink-runtime-web/pom.xml 2024-04-24 10:49:13.216106215 +0800
3	-@@ -259,8 +259,9 @@
4	- </goals>
5	- <configuration>
6	- <nodeVersion>v16.13.2</nodeVersion>
7	-- <downloadRoot>https://repo.huaweicloud.com/nodejs/</downloadRoot>
8	-+ <nodeDownloadRoot>https://repo.huaweicloud.com/nodejs/</nodeDownloadRoot>
9	- <npmVersion>8.1.2</npmVersion>
10	-+ <npmDownloadRoot>https://mirrors.huaweicloud.com/repository/npm/npm/-/</npmDownloadRoot>
11	- </configuration>
12	- </execution>
13	- <execution>

Mflink.spec+10-8

	@@ -10,8 +10,8 @@
10	%global with_tests 0	10	%global with_tests 0
11		11
12	Name: flink	12	Name: flink
13	-Version: 1.17.1	13	+Version: 1.20.4
14	-Release: 6	14	+Release: 7
15	Summary: Stateful Computations over Data Streams	15	Summary: Stateful Computations over Data Streams
16	License: Apache License v2.0	16	License: Apache License v2.0
17	URL: https://github.com/apache/%{name}	17	URL: https://github.com/apache/%{name}
	@@ -26,9 +26,7 @@ Source8: https://github.com/os72/protoc-jar/archive/refs/tags/v3.11.4.tar
26	Source9: https://github.com/os72/protoc-jar-maven-plugin/archive/refs/tags/v3.11.4.zip	26	Source9: https://github.com/os72/protoc-jar-maven-plugin/archive/refs/tags/v3.11.4.zip
27		27
28	Patch0: 0001-add-npm.hw-repo.patch	28	Patch0: 0001-add-npm.hw-repo.patch
29	-Patch1: 0002-fix-compilation-failure.patch
30	Patch2: 0003-Skip-flink-avro-confluent-registry-test.patch	29	Patch2: 0003-Skip-flink-avro-confluent-registry-test.patch
31	-Patch3: 0004-update-npm.hw-repo.patch
32	Patch4: 0005-upgrade-os-maven-plugin-to-1.7.1.patch	30	Patch4: 0005-upgrade-os-maven-plugin-to-1.7.1.patch
33	Patch1000: 1000-Add-protoc-java-support-for-riscv64.patch	31	Patch1000: 1000-Add-protoc-java-support-for-riscv64.patch
34	Patch1001: 1001-Added-support-for-building-the-riscv64-protoc-binari.patch	32	Patch1001: 1001-Added-support-for-building-the-riscv64-protoc-binari.patch
	@@ -46,9 +44,7 @@ Apache Flink is a framework and distributed processing engine for stateful compu
46	%ifarch riscv64	44	%ifarch riscv64
47	%setup -qn %{name}-release-%{version}	45	%setup -qn %{name}-release-%{version}
48	%patch0 -p1	46	%patch0 -p1
49	-%patch1 -p1
50	%patch2 -p1	47	%patch2 -p1
51	-%patch3 -p1
52	%patch4 -p1	48	%patch4 -p1
53	mkdir -p ${HOME}/%{name}-prep_dir	49	mkdir -p ${HOME}/%{name}-prep_dir
54	# protoc	50	# protoc
	@@ -81,8 +77,9 @@ mvn install:install-file -DgroupId=io.confluent -DartifactId=kafka-schema-regist
81	mvn install:install-file -DgroupId=io.confluent -DartifactId=kafka-avro-serializer -Dversion=7.2.2 -Dpackaging=jar -Dfile=%{SOURCE3}	77	mvn install:install-file -DgroupId=io.confluent -DartifactId=kafka-avro-serializer -Dversion=7.2.2 -Dpackaging=jar -Dfile=%{SOURCE3}
82	mvn install:install-file -DgroupId=io.confluent -DartifactId=kafka-schema-serializer -Dversion=7.2.2 -Dpackaging=jar -Dfile=%{SOURCE4}	78	mvn install:install-file -DgroupId=io.confluent -DartifactId=kafka-schema-serializer -Dversion=7.2.2 -Dpackaging=jar -Dfile=%{SOURCE4}
83	mvn install:install-file -DgroupId=org.apache.kafka -DartifactId=kafka-clients -Dversion=7.2.2-ccs -Dpackaging=jar -Dfile=%{SOURCE5}	79	mvn install:install-file -DgroupId=org.apache.kafka -DartifactId=kafka-clients -Dversion=7.2.2-ccs -Dpackaging=jar -Dfile=%{SOURCE5}
84	-mkdir -p ${HOME}/.m2/repository/com/github/eirslett/npm/8.1.2/	80	+# npm local cache for faster builds
85	-cp %{SOURCE6} ${HOME}/.m2/repository/com/github/eirslett/npm/8.1.2/	81	+# mkdir -p ${HOME}/.m2/repository/com/github/eirslett/npm/10.9.0/
		82	+# Note: npm 10.9.0 cache handled by frontend-maven-plugin with mirrors
86		83
87	%build	84	%build
88	if [ "%{_arch}" == riscv64 ]; then	85	if [ "%{_arch}" == riscv64 ]; then
	@@ -109,6 +106,11 @@ find %{buildroot}/opt/apache-%{name}-%{version}/ -type f -name '*.py' \| xargs -i
109	%license LICENSE	106	%license LICENSE
110		107
111	%changelog	108	%changelog
		109	+* Mon May 18 2026 infra_team <zhaiwenjie1@huawei.com> - 1.20.4-7
		110	+- fix CVE: CVE-2026-35194
		111	+- Upgrade to version 1.20.4 to fix code injection vulnerability in JSON functions and LIKE expressions
		112	+- Heal: fix confluent dependency version mismatch (7.5.3 -> 7.2.2) to use pre-installed jars
		113	+
112	* Thu Jan 08 2026 Wenlong Zhang <zhangwenlong@loongson.cn> - 1.17.1-6	114	* Thu Jan 08 2026 Wenlong Zhang <zhangwenlong@loongson.cn> - 1.17.1-6
113	- update nodejs and maven url for loongarch64	115	- update nodejs and maven url for loongarch64
114		116

Rrelease-1.17.1.tar.gz→release-1.20.4.tar.gz+0-0

Binary files do not support preview