confluentinc / librdkafka

The Apache Kafka C/C++ library
Other
7.35k stars 3.11k forks source link

zlib library security vulnerability through to version 1.3 #4653

Closed MiikaL closed 7 hours ago

MiikaL commented 3 months ago

Description

We use the Confluent.Kafka nuget which makes use of librdkafka, and we are receiving a security warning about the version of zlib in use:

One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '8.0': zlib1.dll: CVE-2023-45853(9.8), CVE-2002-0059(9.8), CVE-2022-37434(9.8)

https://nvd.nist.gov/vuln/detail/CVE-2023-45853

Checklist

IMPORTANT: We will close issues where the checklist has not been completed.

Please provide the following information:

janjwerner-confluent commented 1 month ago

Thank you for the report. We are in the process of resolving this issue.

janjwerner-confluent commented 7 hours ago

Resolved in https://github.com/confluentinc/librdkafka/pull/4706