[KAFKA-16645] CVEs in 3.7.0 docker image

• Type: Task
• Status: Resolved
• Priority: Blocker
• Resolution: Resolved
• Affects Version/s: 3.7.0
• Fix Version/s: 3.8.0, 3.7.1
• Assignee: Igor Soarez
• Reporter: Mickael Maison
• Created: 30/Apr/24 08:18
• Updated: 20/May/24 22:33
• Resolved: 20/May/24 22:33

Description

Our Docker Image CVE Scanner GitHub action reports 2 high CVEs in our base image:

apache/kafka:3.7.0 (alpine 3.19.1)
==================================
Total: 2 (HIGH: 2, CRITICAL: 0)

┌──────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├──────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ libexpat │ CVE-2023-52425 │ HIGH │ fixed │ 2.5.0-r2 │ 2.6.0-r0 │ expat: parsing large tokens can trigger a denial of service │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-52425 │
│ ├────────────────┤ │ │ ├───────────────┼─────────────────────────────────────────────────────────────┤
│ │ CVE-2024-28757 │ │ │ │ 2.6.2-r0 │ expat: XML Entity Expansion │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-28757 │
└──────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

Looking at the KIP that introduced the docker images, it seems we should release a bugfix when high CVEs are detected. It would be good to investigate and assess whether Kafka is impacted or not.