Security Fix: Okio CVE-2023-3635 + OkHttp Jar Update

[Mariamalmesfer]

Description

This PR fixes the Okio security vulnerability (CVE-2023-3635) by upgrading from version 1.17.2 to 3.6.0. It also includes an update to the OkHttp jar.

Motivation and Context

A flaw was found in Okio’s GzipSource class that doesn’t handle exceptions properly, allowing potential Denial of Service (DoS) attacks with malformed files.

CVE-2023-3635: Details

Impact

Image Scan showed the vulnerability have been removed.
correlation-report-ibm-lh-presto-okie check.csv

Test Plan

Contributor checklist

• Please make sure your submission complies with our development, formatting, commit message, and attribution guidelines.
• PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
• Documented new properties (with its default value), SQL syntax, functions, or other functionality.
• If release notes are required, they follow the release notes guidelines.
• Adequate tests were added if applicable.
• CI passed.

Release Notes

Please follow release notes guidelines and fill in the release notes below.

 == RELEASE NOTES == =

Security Changes
* Upgrade okio to 3.6.0 :pr:`#23796`
* Upgrade okhttp to 4.12.0 :pr:`#23796`

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: Mariamalmesfer / name: Mariam AlMesfer (e3b47f0, 933260e)