Jan Werner

Results 57 comments of Jan Werner

[Security] Security vulnerability in Netty (CVE-2021-37136 and CVE-2021-37137)

Juan, Thank you for raising this issue. The vulnerabilities have been addressed with an update of the netty dependency.

schema-registry uses some vulnerable dependencies

Pavel, Thank you for raising this issue. The CVEs have been addressed. We recommend using the latest release 6.1.7 http://packages.confluent.io/archive/6.1/confluent-community-6.1.7.zip

Security vulnerabilities: protoc, grpc, kotlin

Mikita, Thank you for raising this issue. The latest release 6.2.6 ships with an updated protobuf-java-3.19.4.jar resolving the issue. https://security.snyk.io/vuln/SNYK-JAVA-COMGOOGLEPROTOBUF-2331703.

Critical Vulnerability CVE-2022-26612

Toby, Thank you for raising this issue. We are aware of those issues and plan on addressing them in an upcoming release cycle.

kafka-rest uses some vulnerable dependencies

Pavel, Thank you for raising this issue. The CVEs have been addressed. We recommend using the latest release 6.1.7 (https://packages.confluent.io/archive/6.1/confluent-community-6.1.7.zip)

kafka-rest uses some vulnerable dependencies

Adam, Thank you for the followup. We are aware of those issues and we are working on addressing them. Thanks! Jan

Debian as base image has vulnerabilities

Thank you Eli for commenting on this. OP can you please close the issue?

Kafka Connect: Amazon vulnerability scan results

Thank you for raising this issue. Confluent Platform updates (including image upgrades) are made available on a quarterly cadence. The issues have been addressed at this point in time.

kafka-rest uses vulnerable log4j version

Pavel, Thank you for raising this issue. The CVEs have been addressed. We recommend using the latest release 5.5.11 http://packages.confluent.io/archive/5.5/confluent-5.5.11-2.12.zip

zlib library security vulnerability through to version 1.3

Thank you for the report. We are in the process of resolving this issue.