Resolving Security Vulnerability CVE-2023-41993

Kafka Connect
1

Hi Team, Our security team has constantly flagging vulnerability CVE-2023-41993 on the cp-kafka-connect image ,

Description as follows,

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

This is what my docker file says,
FROM docker.repo1.uhc.com/confluentinc/cp-kafka-connect:latest

in addition above image is extended to use below dependencies,

snowflake-kafka-connector-1.8.0.jar
snowflake-jdbc-3.13.21.jar
snowflake-jdbc-connector-3.13.21.jar
bc-fips-1.0.2.1.jar
bcpkix-fips-1.0.5.jar

Couldn’t really figure out how to resolve this , please help here!

2

Does the vulnerability report give any pointer to the vulnerability source, e.g., a particular software package? It’s not making sense to me (a macOS vulnerability flagged in a Red Hat UBI 8-based image).

3

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.