confluent-common-docker.advisories.yaml

schema-version: 2.0.2

package:
  name: confluent-common-docker

advisories:
  - id: CVE-2023-45288
    aliases:
      - GHSA-4v7x-pqxf-cx7m
    events:
      - timestamp: 2024-04-13T07:06:08Z
        type: fixed
        data:
          fixed-version: 7.6.0-r4

  - id: CVE-2023-51775
    aliases:
      - GHSA-6qvw-249j-h44c
    events:
      - timestamp: 2024-03-19T16:20:01Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: confluent-common-docker
            componentID: bc7e78f5849d3b9b
            componentName: jose4j
            componentVersion: 0.9.3
            componentType: java-archive
            componentLocation: /usr/share/java/cp-base-new/docker-utils-jar-with-dependencies.jar
            scanner: grype
      - timestamp: 2024-03-20T07:06:26Z
        type: pending-upstream-fix
        data:
          note: Confluent should publish the latest version of common package to their maven repository. They do not have any jars/poms past 7.6.x but they have 7.7.x tags in their GitHub repository.

  - id: CVE-2024-23944
    aliases:
      - GHSA-r978-9m6m-6gm6
    events:
      - timestamp: 2024-03-19T16:20:02Z
        type: detection
        data:
          type: scan/v1
          data:
            subpackageName: confluent-common-docker
            componentID: 3b6ce91dccc68f33
            componentName: zookeeper
            componentVersion: 3.8.3
            componentType: java-archive
            componentLocation: /usr/share/java/cp-base-new/docker-utils-jar-with-dependencies.jar
            scanner: grype
      - timestamp: 2024-03-20T07:06:26Z
        type: pending-upstream-fix
        data:
          note: Confluent should publish the latest version of common package to their maven repository. They do not have any jars/poms past 7.6.x but they have 7.7.x tags in their GitHub repository.