CVE vulnerabilities?

[michaelwagler]

Hi there! Our team would love to start using kafka-ui, I've played with it locally and love the app.

Before we pull it in, I ran grype against the :master tagged image (as of today) to check for security vulnerabilities, and got the following output

NAME                INSTALLED  FIXED-IN  TYPE          VULNERABILITY   SEVERITY
libcrypto1.1        1.1.1t-r3            apk           CVE-2023-0466   Medium
libssl1.1           1.1.1t-r3            apk           CVE-2023-0466   Medium
reactor-netty-core  1.1.6                java-archive  CVE-2014-3488   Medium
reactor-netty-core  1.1.6                java-archive  CVE-2015-2156   High
reactor-netty-core  1.1.6                java-archive  CVE-2019-16869  High
reactor-netty-core  1.1.6                java-archive  CVE-2019-20444  Critical
reactor-netty-core  1.1.6                java-archive  CVE-2019-20445  Critical
reactor-netty-core  1.1.6                java-archive  CVE-2021-21290  Medium
reactor-netty-core  1.1.6                java-archive  CVE-2021-21295  Medium
reactor-netty-core  1.1.6                java-archive  CVE-2021-21409  Medium
reactor-netty-core  1.1.6                java-archive  CVE-2021-37136  High
reactor-netty-core  1.1.6                java-archive  CVE-2021-37137  High
reactor-netty-core  1.1.6                java-archive  CVE-2021-43797  Medium
reactor-netty-core  1.1.6                java-archive  CVE-2022-24823  Medium
reactor-netty-core  1.1.6                java-archive  CVE-2022-41881  High
reactor-netty-http  1.1.6                java-archive  CVE-2014-3488   Medium
reactor-netty-http  1.1.6                java-archive  CVE-2015-2156   High
reactor-netty-http  1.1.6                java-archive  CVE-2019-16869  High
reactor-netty-http  1.1.6                java-archive  CVE-2019-20444  Critical
reactor-netty-http  1.1.6                java-archive  CVE-2019-20445  Critical
reactor-netty-http  1.1.6                java-archive  CVE-2021-21290  Medium
reactor-netty-http  1.1.6                java-archive  CVE-2021-21295  Medium
reactor-netty-http  1.1.6                java-archive  CVE-2021-21409  Medium
reactor-netty-http  1.1.6                java-archive  CVE-2021-37136  High
reactor-netty-http  1.1.6                java-archive  CVE-2021-37137  High
reactor-netty-http  1.1.6                java-archive  CVE-2021-43797  Medium
reactor-netty-http  1.1.6                java-archive  CVE-2022-24823  Medium
reactor-netty-http  1.1.6                java-archive  CVE-2022-41881  High

Just curious if these are on your radar and if there is any plan to address them? I don't think we'll get buy in from our security team to adopt this until at least the Critical ones are remediated.

I appreciate any thoughts!

[Haarolean]

Hey, thanks for reaching out.

We have periodic CVE scans enabled and the next batch of fixes should be delivered within #3812

[Haarolean]

Now green

[Haarolean]

@michaelwagler not sure about grype's reports, we use trivy and also our image is being scanned by snyk at artifacthub. Grype reports dozens of CVEs for reactor-netty-core 1.1.6, which we don't even have installed (even transiently).

[michaelwagler]

Interesting, ok thanks for the context @Haarolean. I wonder what's up with Grype?

[michaelwagler]

ok sounds like this is a known issue with Grype.

[Haarolean]

@michaelwagler thanks for the link!