CVE-2023-6378 about applicationinsights-java HOT 10 OPEN

hi @dreamglobe!

Shading these dependencies is important to ensure that the Application Insights Java agent doesn't break existing applications by introducing conflicting versions of a library.

Netty 4.1.100.Final is already part of the most recent 3.4.18 release.

Logback 1.3.12 will be part of the upcoming December release. Based on the description at https://logback.qos.ch/news.html#1.3.12 it's not exploitable in the context of the Application Insights Java agent.

from applicationinsights-java.

yes, these are already updated in main: #3381 and #3420

from applicationinsights-java.

It's targeted 1 week after the upstream OpenTelemetry Java Instrumentation release, which currently puts it at Dec 20, but with holidays and potential upstream delays, it's more likely to slip a bit this month.

from applicationinsights-java.

@trask Apologies for dropping in.
Both packages already have newer versions than those mentioned -- would it be possible to up them for the December release?
Thanks!

from applicationinsights-java.

@trask I am new here
When Can we expect the December Release?

from applicationinsights-java.

Hi @trask ,

Whether the release was done. We are still having this high vulnerability in our system.

from applicationinsights-java.

#3420,

this was released in Dec. Which version of java agent are you using? Are you sure it is from our Java agent?

from applicationinsights-java.

Hi @trask

3.4.19 version shows high vulnerability CVE-2023-52428

from applicationinsights-java.

Hi @trask

3.4.19 version shows high vulnerability CVE-2023-52428

that was still under investigation, right? they haven't confirmed which versions were impacted.

from applicationinsights-java.

hi @RajaduraiAz, can you open a new issue for this, since it's a different/new CVE?

from applicationinsights-java.