Vulnerabilities in latest docker image of confluentinc/cp-schema-registry:7.2.0

Brijesh · 20 July 2022 13:55

Hi,

We are using confluentinc/cp-schema-registry:7.2.0 for one of our projects.
While scanning the confluentinc/cp-schema-registry:7.2.0 with Aquasec Scanner, we are getting a few CVEs:

These CVE are associated with various Java based packages which have high vulnerabilities associated:
CVE-2022-2048 http2-server 9.4.44.v20210927
CVE-2021-22573 google-oauth-client 1.32.1

How are http2-server, google-oauth-client being used in cp-schema-registry.
Would it be possible to update the packages in cp-schema-registry to fixed versions?

Thanks and Regards
Brijesh

Topic		Replies	Views
Vulnerabilities related to schema registry in 7.2.1 & 7.3.0 Schema Registry	2	2757	24 January 2023
Vulnerabilities in schema registry Schema Registry	1	2314	11 April 2023
Security vulnerability in confluent-7.3.0 ksqlDB	2	3267	10 December 2022
Cp-schema-registry docker config for Basic HTTP authentication Schema Registry	0	2572	29 March 2023
Is the kafka-connect docker image confluentinc/cp-kafka-connect-base:5.5.0 affected by the log4j vulnerability https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228? Kafka Connect	2	3243	14 December 2021

Vulnerabilities in latest docker image of confluentinc/cp-schema-registry:7.2.0

Related topics