confluentinc / confluentinc/rest-utils
rest-utils uses vulnerable version of hibernate-validator
- Dominant language
- Java
- Stars
- 25
- Forks
- 211
- Avg merge
- 14h 33m
- Merged PRs (30d)
- 3
Description
**Description**
I checked confluent kafka 5.5.1 distribution with WhiteSource and find out that rest-utils uses vulnerable library:
- hibernate-validator-6.0.17.Final.jar has CVE-2019-10219 and CVE-2020-10693 vulnerabilities. The way to fix it is to upgrade to org.hibernate.validator:hibernate-validator:6.0.20.Final
**To Reproduce**
Download Confluent Kafka 5.5.1 distribution (for example `curl -O http://packages.confluent.io/archive/5.5/confluent-community-5.5.1-2.12.tar.gz`)
Open share/java/rest-utils folder in it and find hibernate-validator-6.0.17.Final.jar
**Expected behavior**
- hibernate-validator upgraded to 6.0.20.Final or higher
**Actual behaviour**
- hibernate-validator is 6.0.17.Final
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.