Description
We are using Apache Kafka Connect in a critical environment, where our application security engineers control the used software (BOMs). The actual Kafka version (3.8.0) depends on commons-validator:commons-validator:1.7, which has vulnerabilities listed here. I know, that this CVE doesn't apply to Kafka, because it is related to unit testing, but it should not be so difficult to upgrade commons-validator from 1.7 to 1.9.0. I have changed the version in dependencies.gradle to 1.9.0 and at least the build worked without any problems.
Attachments
Issue Links
- links to