Backport CVE-2024-45337 fix (Kafka Exporter 1.9.0) to Strimzi 0.36.x or 0.45.

[kneil31]

We are planning to upgrade from Strimzi 0.36.1 to 0.45.1 but
cannot go directly to 0.46.0+ because:

1. 0.46.0 removes ZooKeeper support - We need to complete
   KRaft migration using 0.45.x first (last version with
   migration tools)
2. Security scans blocking deployment - CVE-2024-45337 is
   flagged as Critical and blocking our image promotion to
   production registry

The Issue

• CVE-2024-45337 (CVSS 9.1 Critical) in
  golang.org/x/crypto/ssh affects Kafka Exporter
• This was fixed in [kafka_exporter v1.9.0](https://github.co
  m/danielqsj/kafka_exporter/releases/tag/v1.9.0) (Feb 2025)
• Strimzi 0.46.0 includes Kafka Exporter 1.9.0, but 0.45.1
  has an older version

Request

Would the Strimzi team consider releasing a 0.45.2 patch
that updates Kafka Exporter to 1.9.0?

This would help users who:

• Need to use 0.45.x for ZooKeeper → KRaft migration (since
  0.46+ removed ZK support)
• Are blocked by security scans requiring CVE remediation
  before deployment

Environment

• Current: Strimzi 0.36.1, Kafka 3.5.1 (ZooKeeper mode)
• Target: Strimzi 0.45.1, Kafka 3.9.0
• Platform: GKE 1.33.x

[im-konge]

Hi, we are planning to do last patch release of 0.45.x at the beginning of 2026 (waiting for Kafka 3.9.2), so I will have a look on having this fixed for the 0.45.2. However I cannot guarantee you any date of the release, as we will want to wait for the last patch release of Kafka 3.9.x (as I mentioned above).

Would it be fine to wait for a while?

[kneil31]

Thank you @im-konge! That's great news. We should be able to wait until Q1 2026.

[im-konge]

Perfect, thanks!

[scholzj]

Why do you think some SSH-related CVE affects Kafka Exporter, which has nothing to do with SSH? The logic to stick with Strimzi 0.36.1, which is likely full of bugs and much worse CVEs, and that was never tested on Kubernetes 1.33 ... because of that is really strange.

[kneil31]

We have an exception earlier and going with exception is a longer route and checking on the latest patch

[kneil31]

Hello Konge - Do we have any update on the patch release of 0.45.x as per our discussion last year

[im-konge]

Hey, we are waiting for release of Kafka 3.9.2 - there is currently RC0, which is being tested (and I opened a PR to add Kafka 3.9.2 to the release-0.45.x branch). Once that is merged, I think we are good to go with the release.

[im-konge]

But TBH, hard to say how long it will take until Kafka 3.9.2 is released.

[kneil31]

Got you Thanks