Will CVE-2021-38153 be remediated in a spring-kafka 2.x release?

[ewan-chalmers]

We have been waiting for a version of spring-kafka which includes kafka-clients 2.8.1 or higher, to remediate CVE-2021-38153

Have been trying to follow where this will arrive.

If I read right, the fix is in v3.0.0-M1.

Two questions follow

• Can we expect the fix to arrive in a v2.x release?
• When will there be a RELEASE status release available?

[artembilan]

There is already Spring for Apache Kafka 2.8.2: https://github.com/spring-projects/spring-kafka/releases/tag/v2.8.2, which is based on kafka-clients-3.0.0 for a while.
According that CVE:

Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher

So, what do we miss, please?
The latest GA version of spring-kafka is fully covered for that CVE.

[garyrussell]

But also see this https://docs.spring.io/spring-kafka/docs/current/reference/html/#update-deps if you are using the embedded broker for testing on Windows.

[garyrussell]

Also note that that CVE is a false positive - it was in common code shared by the client and server, where the vulnerable code is only invoked by the server.

While the -test module does include the server, it is only used for testing so, again, this is not a vulnerability in production code that uses the spring-kafka module.

[ewan-chalmers]

Thanks again @garyrussell

Is there any other reference I could cite regarding false positive status?

[garyrussell]

After further review, there is some client side code affected. However, please note that we were able to convince them to release 2.7.2 and 2.6.3, also including the fix, used by the latest spring-kafka 2.7.x and 2.6.x respectively.

[ewan-chalmers]

Side question: Do tags with name including -RELEASE prefix indicate a more 'stable' version?

[garyrussell]

We no longer use the x.x.x.RELEASE format (the last one was 2.5.x).

2.8.2 is the latest stable release. Prereleases remain as -M1, -M2, -RC1, etc.

[garyrussell]

https://spring.io/projects/spring-kafka#learn

[ewan-chalmers]

Great. Thank you