Repository: provectus/kafka-ui
Issue: CVE fixes, May 23
Labels: scope/backend
type/security

https://github.com/provectus/kafka-ui/actions/runs/4946294159/jobs/8844174426

Issue comments:
@Haarolean Glad you're looking into CVE issues. I ran [grype](https://github.com/anchore/grype) against the latest image locally, and got the list below of CVE vulnerabilities. Are you going to be addressing them as well?
```
libcrypto1.1                 1.1.1t-r3            apk           CVE-2023-0466   Medium
libssl1.1                    1.1.1t-r3            apk           CVE-2023-0466   Medium
netty-reactive-streams       2.0.5                java-archive  CVE-2014-3488   Medium
netty-reactive-streams       2.0.5                java-archive  CVE-2015-2156   High
netty-reactive-streams       2.0.5                java-archive  CVE-2019-16869  High
netty-reactive-streams       2.0.5                java-archive  CVE-2019-20444  Critical                             dzr                                    libclc                                 pocketbase                             virtualfish
netty-reactive-streams       2.0.5                java-archive  CVE-2019-20445  Critical
netty-reactive-streams       2.0.5                java-archive  CVE-2021-21290  Medium                      llamachat                                             lo-rain                                               uhk-agent
netty-reactive-streams       2.0.5                java-archive  CVE-2021-21295  Medium
netty-reactive-streams       2.0.5                java-archive  CVE-2021-21409  Medium
netty-reactive-streams       2.0.5                java-archive  CVE-2021-37136  High
netty-reactive-streams       2.0.5                java-archive  CVE-2021-37137  High
netty-reactive-streams       2.0.5                java-archive  CVE-2021-43797  Medium
netty-reactive-streams       2.0.5                java-archive  CVE-2022-24823  Medium
netty-reactive-streams       2.0.5                java-archive  CVE-2022-41881  High
netty-reactive-streams-http  2.0.5                java-archive  CVE-2014-3488   Medium
netty-reactive-streams-http  2.0.5                java-archive  CVE-2015-2156   High
netty-reactive-streams-http  2.0.5                java-archive  CVE-2019-16869  High
netty-reactive-streams-http  2.0.5                java-archive  CVE-2019-20444  Critical
netty-reactive-streams-http  2.0.5                java-archive  CVE-2019-20445  Critical
netty-reactive-streams-http  2.0.5                java-archive  CVE-2021-21290  Medium
netty-reactive-streams-http  2.0.5                java-archive  CVE-2021-21295  Medium
netty-reactive-streams-http  2.0.5                java-archive  CVE-2021-21409  Medium
netty-reactive-streams-http  2.0.5                java-archive  CVE-2021-37136  High
netty-reactive-streams-http  2.0.5                java-archive  CVE-2021-37137  High
netty-reactive-streams-http  2.0.5                java-archive  CVE-2021-43797  Medium
netty-reactive-streams-http  2.0.5                java-archive  CVE-2022-24823  Medium    rwin_arm64.tar.gz
netty-reactive-streams-http  2.0.5                java-archive  CVE-2022-41881  High      -2e65be/267054247/d4576751-827c-4f81-a9ab-61f248ef6c76?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230517%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20
reactor-netty-core           1.1.5                java-archive  CVE-2014-3488   Medium    ############################################################################################################################################################### 100.0%
reactor-netty-core           1.1.5                java-archive  CVE-2015-2156   High
reactor-netty-core           1.1.5                java-archive  CVE-2019-16869  High
reactor-netty-core           1.1.5                java-archive  CVE-2019-20444  Critical
reactor-netty-core           1.1.5                java-archive  CVE-2019-20445  Critical
reactor-netty-core           1.1.5                java-archive  CVE-2021-21290  Medium
reactor-netty-core           1.1.5                java-archive  CVE-2021-21295  Medium
reactor-netty-core           1.1.5                java-archive  CVE-2021-21409  Medium
reactor-netty-core           1.1.5                java-archive  CVE-2021-37136  High
reactor-netty-core           1.1.5                java-archive  CVE-2021-37137  High
reactor-netty-core           1.1.5                java-archive  CVE-2021-43797  Medium
reactor-netty-core           1.1.5                java-archive  CVE-2022-24823  Medium    20 MB]
reactor-netty-core           1.1.5                java-archive  CVE-2022-41881  High
reactor-netty-http           1.1.5                java-archive  CVE-2014-3488   Medium
reactor-netty-http           1.1.5                java-archive  CVE-2015-2156   High
reactor-netty-http           1.1.5                java-archive  CVE-2019-16869  High
reactor-netty-http           1.1.5                java-archive  CVE-2019-20444  Critical
reactor-netty-http           1.1.5                java-archive  CVE-2019-20445  Critical
reactor-netty-http           1.1.5                java-archive  CVE-2021-21290  Medium
reactor-netty-http           1.1.5                java-archive  CVE-2021-21295  Medium
reactor-netty-http           1.1.5                java-archive  CVE-2021-21409  Medium
reactor-netty-http           1.1.5                java-archive  CVE-2021-37136  High
reactor-netty-http           1.1.5                java-archive  CVE-2021-37137  High
reactor-netty-http           1.1.5                java-archive  CVE-2021-43797  Medium
reactor-netty-http           1.1.5                java-archive  CVE-2022-24823  Medium
reactor-netty-http           1.1.5                java-archive  CVE-2022-41881  High
```

Pull request review comments:

Patch that resolved the issue:
diff --git a/kafka-ui-api/pom.xml b/kafka-ui-api/pom.xml
index 5ebefe31dfe..dc5dad08e2b 100644
--- a/kafka-ui-api/pom.xml
+++ b/kafka-ui-api/pom.xml
@@ -21,12 +21,6 @@
     </properties>
 
     <dependencies>
-        <dependency>
-            <!--TODO: remove, when spring-boot fixed dependency to 6.0.8+ (6.0.7 has CVE) -->
-            <groupId>org.springframework</groupId>
-            <artifactId>spring-core</artifactId>
-            <version>6.0.8</version>
-        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-webflux</artifactId>
@@ -61,7 +55,7 @@
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
-            <version>3.9</version>
+            <version>3.12.0</version>
         </dependency>
         <dependency>
             <groupId>org.projectlombok</groupId>
@@ -97,7 +91,7 @@
         <dependency>
             <groupId>software.amazon.msk</groupId>
             <artifactId>aws-msk-iam-auth</artifactId>
-            <version>1.1.5</version>
+            <version>1.1.6</version>
         </dependency>
 
         <dependency>
@@ -115,7 +109,6 @@
             <groupId>io.projectreactor.addons</groupId>
             <artifactId>reactor-extra</artifactId>
         </dependency>
-<!-- https://github.com/provectus/kafka-ui/pull/3693 -->
         <dependency>
             <groupId>org.json</groupId>
             <artifactId>json</artifactId>
diff --git a/pom.xml b/pom.xml
index a5a450d294b..048f2370f03 100644
--- a/pom.xml
+++ b/pom.xml
@@ -36,7 +36,7 @@
         <protobuf-java.version>3.21.9</protobuf-java.version>
         <scala-lang.library.version>2.13.9</scala-lang.library.version>
         <snakeyaml.version>2.0</snakeyaml.version>
-        <spring-boot.version>3.0.5</spring-boot.version>
+        <spring-boot.version>3.0.6</spring-boot.version>
         <kafka-ui-serde-api.version>1.0.0</kafka-ui-serde-api.version>
         <odd-oddrn-generator.version>0.1.15</odd-oddrn-generator.version>
         <odd-oddrn-client.version>0.1.23</odd-oddrn-client.version>


Test patch: