[Bug] Amazon Ion-Java has a vulnerability CVE-2024-21634

[nikhil-ctds]

Search before asking

• I searched in the issues and found nothing similar.

Read release policy

• I understand that unsupported versions don't get bug fixes. I will attempt to reproduce the issue on a supported version of Pulsar client and Pulsar broker.

Version

Version - 3.3.0-SNAPSHOT
Branch - master

Minimal reproduce step

Ran security scan on pulsar-io-kinesis connector
https://security.snyk.io/vuln/SNYK-JAVA-SOFTWAREAMAZONION-6153869

What did you expect to see?

No Vulnerabilities

What did you see instead?

Found a High Vulnerability on software.amazon.ion:ion-java version 1.0.2
CVE-2024-21634
Github Advisory link - GHSA-264p-99wq-f4j6)

Anything else?

Pulsar doesn't have a direct dependency on Ion-java
Pulsar has a dependency on aws-java-sdk-core

<groupId>com.amazonaws</groupId>
<artifactId>aws-java-sdk-core</artifactId>
<version>1.12.262</version>

Which in-turn has a dependency on ion-java

<groupId>software.amazon.ion</groupId>
<artifactId>ion-java</artifactId>
<version>1.0.2</version>

The patch is for ion-java included in 1.10.5 version as mentioned here

The domain name has changed from software.amazon.ion to com.amazon.ion
https://mvnrepository.com/artifact/com.amazon.ion/ion-java/1.10.5

Aws-sdk-java-core has dropped the ion dependency in v1.12.638

The fix would be to update the aws-sdk-java-core version to <version>1.12.638</version> in pulsar

Are you willing to submit a PR?

• I'm willing to submit a PR!