apache / apache/pulsar

[Security] 3.0.2 and 3.1.1 has 2 fixable security vulnerabilities.

Open
#21,457 3 comments 0 reactions 2 assignees Claimed by @gaoran10 View on GitHub
type/bug
Dominant language
Java
Stars
15.3k
Forks
3.8k
Avg merge
1d 14h
Merged PRs (30d)
160

Description

### Search before asking

- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.

### Version

The second candidate for v3.0.2 and release 3.1.1.

### Minimal reproduce step

Used a container security scanner included with Red Hat Advanced Cluster Security for Kubernetes, Stackrox Scanner.

### What did you expect to see?

Vulnerabilities that should have been fixed in 3.0.2 are showing up with the included version of Trino version 368.

### What did you see instead?

![Screenshot 2023-10-27 171327](https://github.com/apache/pulsar/assets/864349/9cd1693e-d8df-4a59-b7cc-aaf04cb63d49)
- 2 Vulnerabilities that can be fixed
CVE-2021-42550 - Logback-core - currently using version 1.2.3
CVE-2023-3635 - Okio - currently using version 3.14.9

- 1 of them maybe a false positive:
~~CVE-2023-4586 - Netty - currently using 4.1.100.final~~
CVE-2023-0833 - Okhttp - currently using version 1.17.2 (Talks about RH AMQ-Streams; may not be relevant to Pulsar)?

### Anything else?
Some of this has been mentioned in #18348 previously. Issue should not be tagged as `type/bug` but `component/security`.

Should upgrade Trino from 368 to 430, if possible.

### Are you willing to submit a PR?

- [ ] I'm willing to submit a PR!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.