search

Hurence / logisland

Scalable stream processing platform for advanced realtime analytics on top of Kafka and Spark. LogIsland also supports MQTT and Kafka Streams (Flink being in the roadmap). The platform does complex event processing and is suitable for time series analysis. A large set of valuable ready to use processors, data sources and sinks are available.
https://logisland.github.io
Other
109 stars 28 forks source link

Potential security vulnerability in the zstd C library.Can you help upgrade to patch versions? #605

Open HelenParr opened 2 years ago

HelenParr commented 2 years ago

Hi, @oalam, @MiniPlayer , I'd like to report a vulnerability issue in com.hurence.logisland:logisland-utils:1.4.0.

Issue Description

I noticed that com.hurence.logisland:logisland-utils:1.4.0 directly depends on com.github.luben:zstd-jni:v1.4.5-6 in the pom. However, as shown in the following dependency graph, com.github.luben:zstd-jni:v1.4.5-6 sufferes from the vulnerability which the C library zstd(version:1.4.5) exposed: CVE-2021-24032.

Dependency Graph between Java and Shared Libraries

image (12)

Suggested Vulnerability Patch Versions

com.github.luben:zstd-jni:v1.4.9-1 (>=v1.4.9-1) has upgraded this vulnerable C library zstd to the patch version 1.4.9.

Java build tools cannot report vulnerable C libraries, which may induce potential security issues to many downstream Java projects. Could you please upgrade this vulnerable dependency?

Thanks for your help~ Best regards, Helen Parr