Inquiry: Known Vulnerabilities in Latest UAA Release & Java 21 Support Plans

[Yogeshkumarb57]

Hello UAA maintainers,

• Are there any known security vulnerabilities in the latest Cloud Foundry UAA release?

• What are the plans and timeline for releasing UAA with Java 21 support, especially to address any Java runtime-related security or compatibility issues?

Thank you!

[strehle]

Hi,
no, we dont know any CVEs yet. With lastest I mean 78.1.0 https://github.com/cloudfoundry/uaa/releases/tag/v78.1.0 and this is based and was released with Java 21.

[Yogeshkumarb57]

hi @strehle, we have report in CSV file format, PFA CSV for the same.
[report-vulnerabilities-08_07_2025, 13_56_52.csv](Deleted link)

[strehle]

ok, I cannot explain, why the commits and the versions are in that mix. I mean I see that the git commit point to actual version, but then the version for a dependency is not correct. e.g. bouncy castle is not outdated but the report says it.
Same is for all other dependendies.... you see CVEs from last years...

This means, the report is not correct.

[strehle]

Hi, I hope it was clarified, if not I recommend that you use the downloaded packages from
https://github.com/cloudfoundry/uaa/releases/tag/v78.1.0 and scan these assemblies.

The findings about "slate" are not treated as UAA runtime issues. We use slate to generate https://docs.cloudfoundry.org/api/uaa/ but we dont have this docs in each UAA.

[Yogeshkumarb57]

ok, thanks, we will ignore slate module findings.

[strehle]

yes you can ignore slate dependencies in your env.
About CVEs you should also update UAA, then your are fine because latest https://github.com/cloudfoundry/uaa-release/releases/tag/v78.2.0 provides CVE fixes for tomcat