[fix][sec] Upgrade Debezium oracle connector version to avoid CVE-2023-4586

[nikhilerigila09]

Fixes #22626

Motivation

Avoid CVE-2023-4586

Modifications

Upgrade debezium-oracle-connector version to 2.2.0.Final
which avoids org.infinispan:[email protected] which has the vulnerability and uses org.infinispan:[email protected] instead, which has no vulnerabilities.

Verifying this change

• Make sure that the change passes the CI checks.

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment

Documentation

• doc
• doc-required
• doc-not-needed
• doc-complete

[nicoloboschi]

LGTM

[lhotari]

Just wondering that we are upgrading this connector to a newer Debezium version than the others. It seems like a hack. I wonder why we are sticking to an old Debezium version for others.

[nikhil-ctds]

@lhotari We could update the debezium version for others as well. Since only debezuim-oracle-connector had vulnerabilites (indirectly due to infinispan-client-hotrod) , i updated for oracle. I haven't checked for the other debezium connectors if there are any transitive dependencies which have vulnerabilities.

[lhotari]

@nikhil-ctds Did you ensure that tests pass? I don't see the tests passing and this PR will need to be reverted. @nicoloboschi @shoothzj Please review the revert PR #22668

[nikhilerigila09]

@lhotari
The CI check failed in CI Flaky - System - Pulsar IO - Oracle. I haven't tested it, but i see an issue open for flaky test - #13953

[lhotari]

@lhotari The CI check failed in CI Flaky - System - Pulsar IO - Oracle. I haven't tested it, but i see an issue open for flaky test - #13953

@nikhilerigila09 In this case, it's the test that validates changes in this area. It was failing consistently. This PR has been reverted in #22668, so there's a new chance to attempt to address CVE-2023-4586 in a way that doesn't break existing functionality.

[lhotari]

@nikhilerigila09 #22668 describes the way how to find the error logs of an integration test.

[lhotari]

Note: This PR shouldn't be cherry-picked since it breaks the connector. Reverted in #22668.