Security Fix: Okio CVE-2023-3635 + OkHttp Jar Update

[Mariamalmesfer]

Description

This PR fixes the Okio security vulnerability (CVE-2023-3635) by upgrading from version 1.17.2 to 3.6.0. It also includes an update to the OkHttp jar from 3.9.0 to 4.12.0

Motivation and Context

A flaw was found in Okio’s GzipSource class that doesn’t handle exceptions properly, allowing potential Denial of Service (DoS) attacks with malformed files.

CVE-2023-3635: Details

Impact

Image Scan showed the vulnerability have been removed.
correlation-report-ibm-lh-presto-okie check.csv

Test Plan

Contributor checklist

• Please make sure your submission complies with our development, formatting, commit message, and attribution guidelines.
• PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
• Documented new properties (with its default value), SQL syntax, functions, or other functionality.
• If release notes are required, they follow the release notes guidelines.
• Adequate tests were added if applicable.
• CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

 == RELEASE NOTES == =
Security Changes
* Upgrade okio to 3.6.0 in response to `CVE-2023-3635 <https://github.com/advisories/GHSA-w33c-445m-f8w7>`_. :pr:`23796`
* Upgrade okhttp to 4.12.0 in response to `CVE-2023-3635 <https://github.com/advisories/GHSA-w33c-445m-f8w7>`_.  :pr:`23796`

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: Mariamalmesfer / name: Mariam AlMesfer (4bbd3de)

[steveburnett]

Thanks for the release note entry! Nit to remove # from the PR number.

 == RELEASE NOTES == =

Security Changes
* Upgrade okio to 3.6.0 :pr:`23796`
* Upgrade okhttp to 4.12.0 :pr:`23796`

[arhimondr]

What issue does this dependency cause? Is this dependency needed in runtime?

[Mariamalmesfer]

The exclusion prevents a build failure due to scope conflicts. Without it, Maven reports scope issues that lead to build failures. This dependency isn't needed at runtime; it's only required to pass the build checks.

[prestodb-ci]

@ethanyzhang imported this issue into IBM GitHub Enterprise