[KAFKA-16825] CVE vulnerabilities in Jetty and netty

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.7.0
• Fix Version/s: 3.8.0, 3.7.1
• Assignee: Mickael Maison
• Reporter: mooner
• Due: 23/May/24
• Created: 23/May/24 06:16
• Updated: 23/May/24 15:35
• Resolved: 23/May/24 15:06

Description

There is a vulnerability (CVE-2024-29025) in the passive dependency software Netty used by Kafka, which has been fixed in version 4.1.108.Final.

There is also a vulnerability (CVE-2024-22201) in the passive dependency software Jetty, which has been fixed in version 9.4.54.v20240208.

When will Kafka upgrade the versions of Netty and Jetty to fix these two vulnerabilities?

Reference website:

https://nvd.nist.gov/vuln/detail/CVE-2024-29025

https://nvd.nist.gov/vuln/detail/CVE-2024-22201

Issue Links

• links to: GitHub Pull Request #16038