KE-42144 & KE-42145 Fix vulnerabilities, upgrade tomcat-embed-core & …

…netty (apache#638)

* KE-42144 Upgrade tomcat-embed-core to 9.0.76

* KE-42145 Upgrade netty-handler to 4.1.94.Final

external/kafka-0-10-sql/pom.xml

@@ -130,6 +130,12 @@
       <artifactId>zookeeper</artifactId>
       <version>3.5.7</version>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>io.netty</groupId>
+          <artifactId>netty-handler</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>net.sf.jopt-simple</groupId>

external/kafka-0-10/pom.xml

@@ -102,6 +102,12 @@
       <artifactId>zookeeper</artifactId>
       <version>3.5.7</version>
       <scope>test</scope>
+      <exclusions>
+        <exclusion>
+          <groupId>io.netty</groupId>
+          <artifactId>netty-handler</artifactId>
+        </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>net.sf.jopt-simple</groupId>

pom.xml

@@ -202,7 +202,9 @@
     <bouncycastle.version>1.60</bouncycastle.version>
     <tink.version>1.6.0</tink.version>
     <tomcat.version>9.0.68</tomcat.version>
-    <tomcat-embed-core.version>9.0.72</tomcat-embed-core.version>
+    <tomcat-embed-core.version>9.0.76</tomcat-embed-core.version>
+    <netty.version>4.1.89.Final</netty.version>
+    <netty-handler.version>4.1.94.Final</netty-handler.version>
     <!--
     If you are changing Arrow version specification, please check
     ./python/pyspark/sql/pandas/utils.py, and ./python/setup.py too.
@@ -777,7 +779,12 @@
       <dependency>
         <groupId>io.netty</groupId>
         <artifactId>netty-all</artifactId>
-        <version>4.1.89.Final</version>
+        <version>${netty.version}</version>
+      </dependency>
+      <dependency>
+        <groupId>io.netty</groupId>
+        <artifactId>netty-handler</artifactId>
+        <version>${netty-handler.version}</version>
       </dependency>
       <dependency>
         <groupId>org.apache.derby</groupId>