Upgrade commons-compress to version 1.19 due to CVE-2018-11771

[justinchuch]

CVE-2018-11771

According to sourceclear:

https://www.sourceclear.com/vulnerability-database/security/denial-of-service-dos-/java/sid-7319

commons-compress is vulnerable to denial of service (DoS) attacks.

Although it looks like hadoop-gremlin does not use the library directly, but still may be worth upgrading it.

Run docker/build.sh -t -i on my local, and the Reactor Summary reports BUILD SUCCESS.

[spmallette]

VOTE +1

[robertdale]

VOTE +0
I'm not against the change but in the grand scheme of things it does very little. Between spark, sparql, and hadoop -gremlins, there are multiple high and medium severity issues. Unfortunately, the versions we use or their transitive dependencies aren't really maintained any more hence the difficulty, even impossibility, in trying to update any of them.

[spmallette]

That's a decent point. Let's consider that thinking for future PRs of this nature. I hope we can make a big upgrade on these spark/hadoop dependencies in 3.5.0. I didn't realize sparql stuff was heavily dated - that might be able to be resolved more easily prior to 3.5.0 (unless you already tried @robertdale )

[justinchuch]

Agree. If possible, perhaps define a list of supported libraries that may keep maintained?