confluentinc/kafka-images

Vulnerabilities reported in the cp-server-connect-base image

cijujoseph opened this issue · 7 comments

cijujoseph commented

We are finding the following vulnerabilities (rated as HIGH by by ECR scan) in the confluentinc/cp-server-connect-base:7.4.0 image:

  • CVE-2022-45688
    • Remediation - upgrade your installed software packages to the proposed fixed in version and release. Update json to 20230227

There is also a few MEDIUM rated vulns:

janjwerner-confluent commented

@cijujoseph
Thank you for raising this issue. We are aware of those dependencies and plan to resolve them in the upcoming patch release.

  • 👍1
zacharycase commented

similarly just to add on I'm seeing some of the same vulnerabilities on the cp-kafka-connect 7.4.0-2-ubi image

zacharycase commented

@cijujoseph Thank you for raising this issue. We are aware of those dependencies and plan to resolve them in the upcoming patch release.

👋 Hello @janjwerner-confluent is there an expected release date for that patch?

barambani commented

@janjwerner-confluent do you know if CVE-2022-45688 is resolved in 3.4.1 ? I can't find mentions in the release notes. Thank you 🙇.

janjwerner-confluent commented

@barambani
I don't know about the update process in AK. I expect it to be resolved in CP 7.4.1

dkirrane commented

The following Vulnerabilities in confluentinc/cp-kafka-connect:latest

VULNERABILITY TITLE SEVERITY CVE
Red Hat Update for python3 (RHSA-2023:3591) CRITICAL CVE-2023-24329
Azul Java Multiple Vulnerabilities Security Update April 2023 SERIOUS CVE-2023-21930, CVE-2023-21954, CVE-2023-21967, CVE-2023-21939, CVE-2023-21937, CVE-2023-21938, CVE-2023-21968
janjwerner-confluent commented

I expect those to be resolved in patch release for q3 2023.