Confluent Platform patch release version 5.5.15 contains fixes that resolve vulnerabilities in Confluent owned components and in various dependency versions depended upon by Confluent Platform components.
Security Vulnerabilities
The following vulnerabilities were resolved in this update:
| CVE | CVSS | Impacted Component | Upgraded Component |
| N/A | 4.4 |
confluent-kafka < 5.5.15 confluent-server < 5.5.15 confluent-security-plugins < 5.5.15 |
confluent-kafka:5.5.15 confluent-server:5.5.15 confluent-security-plugins:5.5.15 More information will be provided in CONFSA-2023-01. |
| N/A | 4.4 | confluent-ksqldb < 5.5.15 |
confluent-ksqldb:5.5.15 More information will be provided in CONFSA-2023-04. |
Resolved hygiene issues related to Open-Source dependencies
The following package upgrades are included in this release version and are made available to enhance the security hygiene of Confluent software, as no exploitable vector was identified for the CVEs present in impacted packages. We have provided the CVE identifier to assist customers with analysis.
| CVE | CVSS | Impacted Package Version | Upgraded Package Version |
| CVE-2020-10650 | 8.1 | jackson-databind < 2.9.10.4 | jackson-databind:2.14.2 |
| CVE-2020-36518 | 7.5 | jackson-databind < 2.13.2.1 | jackson-databind:2.14.2 |
| CVE-2021-31684 | 7.5 | net.minidev:json-smart < 2.4.4 | net.minidev:json-smart:2.4.4 |
| CVE-2022-42004 | 7.5 | com.fasterxml.jackson.core:jackson-databind < 2.13.4 | com.fasterxml.jackson.core:jackson-databind:2.14.2 |
| CVE-2022-45685 | 7.5 | org.codehaus.jettison_jettison < 1.5.2 | org.codehaus.jettison_jettison:1.5.2 |
| CVE-2022-45693 | 7.5 | org.codehaus.jettison_jettison < 1.5.2 | org.codehaus.jettison_jettison:1.5.2 |
| CVE-2022-41881 | 7.5 | netty:netty < 4.1.86 | netty:netty:4.1.86 |
| CVE-2022-42003 | 7.5 | com.fasterxml.jackson.core:jackson-databind < 2.13.4.1 | com.fasterxml.jackson.core:jackson-databind:2.14.2 |
| CVE-2022-40150 | 7.5 | com.fasterxml.woodstox_woodstox-core < 5.4.0 | com.fasterxml.woodstox_woodstox-core:5.4.0 |
| CVE-2022-41915 | 6.5 | netty:netty < 4.1.86 | netty:netty:4.1.86 |
| CVE-2021-37533 | 6.5 | commons-net_commons-net < 3.9.0 | commons-net_commons-net:3.9.0 |
| CVE-2022-41854 | 6.5 | org.yaml:snakeyaml<1.32 | org.yaml:snakeyaml:1.33 |