Security vulnerability on snowplow-stream-enrich-kinesis-3.8.2.jar about enrich HOT 9 CLOSED

hi @benjben can you accommodate the above changes on the next release?
When is the next release planned?

from enrich.

Hi @benjben any update on this?

from enrich.

Hi @vishalrv1904 , I'm currently working on next Enrich release, that will come hopefully before the end of this week. I will address security vulnerabilities. Please note that in this release we will stop publishing Stream Enrich assets, so if you're still using snowplow-stream-enrich-kinesis, you'll need to switch to enrich-kinesis. Setup guide can be found here.

from enrich.

Hi @benjben , We've successfully transitioned from using snowplow-stream-enrich-kinesis to enrich-kinesis. While we're aware that a new release of enrich-kinesis is anticipated in the near future, we wanted to proactively reach out and highlight a few vulnerabilities that we'd appreciate having addressed in the upcoming release. Please find the vulnerabilities that have been identified through our comprehensive security assessments.

Jar: snowplow-enrich-kinesis-3.8.2.jar

Security Vulnerabilities:

• CVE-2022-1471
• CVE-2022-31159
• CVE-2021-29425
• CVE-2022-41854
• CVE-2022-38752
• CVE-2023-2976
• CVE-2023-34462
• GHSA-xpw8-rcwv-8f8p
• CVE-2020-8908

from enrich.

Hi @raghulrider @vishalrv1904 ,

Awesome that you could migrate swiftly to enrich-kinesis.

In case you missed it 3.9.0 has been released without high and critical vulnerabilities.

from enrich.

Hi @benjben, The 3.9.0 fixed most of the security vulnerabilities, but still there are some security vulnerabilities remain. It would be great if these vulnerabilities are addressed in the next release. Your efforts are much appreciated!

Jar: snowplow-enrich-kinesis-3.9.0.jar

Security Vulnerabilities:

• CVE-2022-1471 (CRITICAL)
• CVE-2023-2976 (HIGH)
• CVE-2021-29425 (MEDIUM)
• CVE-2020-8908 (LOW)

from enrich.

Hi @raghulrider , may I ask which tool you are using to detect vulnerabilities ?

from enrich.

Hi @raghulrider , may I ask which tool you are using to detect vulnerabilities ?

The above mentioned vulnerabilities were identified by Orca Security Scanning tool.

from enrich.

Hi, @benjben can you approve this PR for the next release?
#817
Which can help us to resolve the above-mentioned vulnerabilities.

from enrich.