[IO] Upgrade mariadb jdbc driver version to address vulnerabilities

[lhotari]

Motivation

OWASP dependency check fails with this error:

Error:  mariadb-java-client-2.6.0.jar: CVE-2020-28912, CVE-2021-46668, CVE-2021-46669, CVE-2021-46666, CVE-2021-46667, CVE-2021-46664, CVE-2021-46665, CVE-2021-46662, CVE-2021-46663, CVE-2021-46661

Modifications

• upgrade mariadb jdbc driver version to 3.0.3

[lhotari]

It looks like a false positive, jeremylong/DependencyCheck#2863 . It seems that the check added by #13972 has never passed? @dlg99 Can you confirm?

[dlg99]

@lhotari the check did pass before it was merged. The threat DB updates independently, sometimes several times a day and owasp plugin may misdetect something. If these are indeed false positives they can be suppressed https://github.com/apache/pulsar/blob/master/src/owasp-dependency-check-suppressions.xml

[dlg99]

I'll add that OWASP check had matched server vulnerabilities against client java libraries (e.g. clickhouse db server were matched to clickhouse-jdbc driver etc.) These happen due to too broadly matching patterns in the threat DB, if I understand correctly, and are safe to suppress.

[dlg99]

Please suppress false positives for owasp check

[nodece]

Any updates?

[nodece]

MariaDB Connector/J 3.0.3 is NOT fully compatible with the latest release of version 2.7.

[lhotari]

@nodece please elaborate more about the incompatibility.

[nodece]

The information from https://mariadb.com/kb/en/mariadb-connector-j-303-release-notes/.

NOTE: MariaDB Connector/J 3.0.3 is NOT fully compatible with the latest release of version 2.7.

[lhotari]

closing this since #14593 resolves the OWASP dependency check false alarm.