When will the latest sec vulnerability be fixed in Smallrye Reactive Messaging?

[RJJdeVries]

Hi there,

There's a security vulnerability in the Apache Kafka client version using in the quarkus-smallrye-reactive-messaging-kafka dependency. It's the Apache Kafka versions below 3.2. Does anyone know when this will be fixed in Quarkus?

It's this one: CVE-2023-25194

Thanks!

[quarkus-bot[bot]]

/cc @Ladicek (smallrye), @cescoffier (reactive-messaging), @jmartisk (smallrye), @ozangunalp (reactive-messaging), @phillip-kruger (smallrye), @radcortez (smallrye)

[cescoffier]

The issue is only for Kafka Connect, not the Kafka client.

[ozangunalp]

This CVE specifically involves the Kafka Connect API, so AFAIU it isn't relevant for quarkus-smallrye-reactive-messaging-kafka.

[cescoffier]

In addition, the update to 3.4.0 is in progress (targeting Quarkus 3.x at the moment)

[ozangunalp]

I think the remediation proposed with Kafka 3.4.0 with the org.apache.kafka.disallowed.login.modules property is on the Kafka broker side.

[cescoffier]

Ah... in that case, the update of the client won't help :-D