Current version 3.6.2 has 1 CVE: CVE-2024-12798

[JoshuelNobre]

Expected behavior

No security vulnerabilities should be present in the current version of Application Insights.

Actual behavior

The current version of Application Insights Java agent uses a vulnerable version of logback-core (1.3.14) which contains CVE-2024-12798, allowing potential arbitrary code execution through JaninoEventEvaluator component.

To Reproduce

I generated a base image using Application Insights and, upon scanning the image with Trivy, I found this vulnerability.

System information

Please provide the following information:

• SDK Version:
• OS type and version: Linux, redhat
• Application Server type and version (if applicable): 3.6.2
• Using spring-boot? yes
• Additional relevant libraries (with version, if applicable): logback

Screenshots

[trask]

this is resolved by #3998 and will be included in 3.7.0 release later this month