Confluent For Kubernetes 2.3.2 contains numerous fixes that resolve CVEs in various open-source dependency versions depended upon by Confluent For Kubernetes components. Please note that none of the CVEs were identified to be exploitable in nature, and are only made available to enhance the security hygiene of Confluent software, unless otherwise noted.
The following package upgrades are included in this release version:
Resolved CVEs related to Open-Source Dependencies
|
CVE |
CVSS |
Vulnerable Package Version |
Upgraded Package Version |
|
7.5 |
golang.org/x/crypto/ssh < 0.0.0-20220314234659-1baeb1ce4c0b |
golang.org/x/crypto/ssh:v0.0.0-20220525230936-793ad666bf5e |
|
|
9.1 |
emicklei/go-restful<2.16.0 |
emicklei/go-restful:v2.16.0+incompatible |
|
|
7.5 |
containerd/containerd<1.4.13 |
containerd/containerd:v1.6.6 |
|
|
5.5 |
containerd/containerd<1.5.13 |
containerd/containerd:v1.6.6 |
|
|
7.5 |
go<1.17.9 |
go:1.17.12 |
|
|
7.5 |
go<1.17.9 |
go:1.17.12 |
|
|
5.3 |
go<1.17.10 |
go:1.17.12 |
|
|
7.5 |
jackson-databind<2.12.6.1 |
jackson-databind:2.13.2.2 |