Open flauflauf opened 3 years ago
Any update on this issue ? By keeping kramdown to hardcoded version, logstash-devutils (logstash-devutils 2.4.0 as of now) latest versions still contains the critical vulnerability for kramdown. We cannot upgrade kramdown package separately using gemfile as it throws incompatible errors
Bundler could not find compatible versions for gem "kramdown":
#10 34.59 In Gemfile:
#10 34.59 kramdown (~> 2.4.0)
#10 34.59
#10 34.59 logstash-devutils (~> 2.4.0.pre.java) was resolved to 2.4.0, which depends
#10 34.59 on
#10 34.59 kramdown (= 1.14.0)
Can someone please take a look on this and update the kramdown dependency version in upcoming releases of logstash-devutils ? this will help in running latest version of utils without any vulnerabilities.
We are still encountering this CRITICAL rated CVE. Can the logstash team please advise or post a bulletin if logstash is not affected?
logstash-devutils has a runtime dependency to the outdated Kramdown version 1.14.0. This causes Trivy to report the critical vulnerability CVE-2020-14001 for logstash as a whole:
Trivy deduces this by reading logstash's
Gemfile.lock
file, which contains the following:An update of kramdown to version 2.3.0 would fix the issue.