Skip to content

Releases: exasol/kafka-connector-extension

Release list

2.0.0 Fixed vulnerabilities CVE-2026-10532, CVE-2026-13006, CVE-2025-12383, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54518, CVE-2026-59888, CVE-2026-59889, CVE-2026-9563, CVE-2026-59901, CVE-2026-10050, CVE-2026-59949

2.0.0 Fixed vulnerabilities CVE-2026-10532, CVE-2026-13006, CVE-2025-12383, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54518, CVE-2026-59888, CVE-2026-59889, CVE-2026-9563, CVE-2026-59901, CVE-2026-10050, CVE-2026-59949 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Jul 07:21
2.0.0
5ea4515
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release fixes the following 14 vulnerabilities:

CVE-2026-10050 (CWE-173) in dependency org.eclipse.jetty:jetty-security:jar:9.4.57.v20241219:test

org.eclipse.jetty:jetty-security - Improper Handling of Alternate Encoding

References

CVE-2026-59949 (CWE-125) in dependency at.yawk.lz4:lz4-java:jar:1.10.1:runtime

at.yawk.lz4:lz4-java - Out-of-bounds Read

References

CVE-2026-59901 (CWE-835) in dependency io.netty:netty-codec-compression:jar:4.2.15.Final:test

netty-codec - Bzip2Decoder infinite loop DoS via malformed stream

References

CVE-2026-10532 (CWE-502) in dependency ch.qos.logback:logback-core:jar:1.5.34:compile

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.

More precisely, an attacker able to influence serialized data sent to
SimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects.

Although deserialization is heavily restricted by HardenedObjectInputStream and no
practical way to achieve remote code execution or significant privilege
escalation has been identified, this issue constitutes a bypass of the
intended security restrictions.

This issue affects logback: through 1.5.33 inclusive.

References

CVE-2026-13006 (CWE-20) in dependency ch.qos.logback:logback-core:jar:1.5.34:compile

ACE vulnerability in conditional configuration file processing by QOS.CH logback-core up to and including version 1.5.36 in Java applications, allows an attacker to execute arbitrary code circumventing existing protections against CVE-2025-11226 by compromising an existing logback configuration file or by injecting an environment variable before program execution.

A successful attack requires the presence of Janino library to be present on the user's class path. In addition, the attacker must  have write access to a
configuration file. Alternatively, the attacker could inject a malicious
environment variable pointing to a malicious configuration file. In both
cases, the attack requires existing privilege.

Please note that in logack version 1.5.37 conditional processing using Janino was removed.

References

CVE-2025-12383 (CWE-362) in dependency org.glassfish.jersey.core:jersey-client:jar:2.36:test

In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)

References

CVE-2026-54512 (CWE-184) in dependency com.fasterxml.jackson.core:jackson-databind:jar:2.18.1:compile

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled and a type identifier contains generic parameters (i.e. the type ID string contains <), DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring before <) against the configured PTV. If the container type is approved, the method parses the full canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type without ever validating the nested type arguments against the PTV. The nested type arguments are then resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type ID can therefore place a denied class as a generic type parameter of an allowed container � for example java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

References

CVE-2026-54513 (CWE-184) in dependency com.fasterxml.jackson.core:jackson-databind:jar:2.18.1:compile

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://guide.sonatype.com/vulnerability/CVE-2026-54513 for details

References

CVE-2026-54514 (CWE-918) in dependency com.fasterxml.jackson.core:jackson-databind:jar:2.18.1:compile

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.0.0 until 2.18.8, 2.21.4, and 3.1.4, JDKFromStringDeserializer constructed InetSocketAddress with new InetSocketAddress(host, port), which performs eager DNS name resolution for hostname inputs at deserialization time. An application that binds untrusted JSON into a type containing an InetSocketAddress field issues an attacker-chosen DNS query during readValue, before any application-level validation or connect logic. The fix uses InetSocketAddress.createUnresolved(host, port), deferring DNS to an explicit connect. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://guide.sonatype.com/vulnerability/CVE-2026-54514 for details

References

CVE-2026-54515 (CWE-915) in dependency com.fasterxml.jackson.core:jackson-databind:jar:2.18.1:compile

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @jsonformat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of ...

Read more

Contributors

JSONVIEW, JsonIgnoreProperties, and jsonformat
Assets 8
Loading

1.7.17 Migrate to Java

1.7.17 Migrate to Java

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 Jun 10:36
1.7.17
9938850
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release includes internal refactoring. It migrates the source code from Scala to Java to simplify development. It also improves test coverage.

Refactoring

  • #195: Migrate production code from Scala to Java
  • #196: Migrate test code from Scala to Java
  • #198: Enable UDF coverage collection for integration tests
  • #199: Replace Scala collections with Java collections where possible

Security updates

Dependency Updates

Compile Dependency Updates

  • Updated ch.qos.logback:logback-classic:1.5.20 to 1.5.34
  • Updated com.exasol:import-export-udf-common-scala:2.0.1 to 2.0.2
  • Removed com.google.code.gson:gson:2.13.1
  • Updated io.confluent:kafka-avro-serializer:7.9.0 to 7.9.2
  • Updated org.apache.kafka:kafka-clients:3.9.1 to 3.9.2
  • Removed org.eclipse.jetty.http2:http2-common:9.4.58.v20250814

Test Dependency Updates

  • Updated com.exasol:exasol-testcontainers:7.1.7 to 7.3.0
  • Removed com.exasol:extension-manager-integration-test-java:0.5.16
  • Added com.exasol:udf-debugging-java:0.6.18
  • Added com.google.code.gson:gson:2.13.1
  • Removed com.sksamuel.avro4s:avro4s-core_2.13:4.1.2
  • Updated io.confluent:kafka-streams-avro-serde:7.9.0 to 7.9.5
  • Updated io.github.embeddedkafka:embedded-kafka-schema-registry_2.13:7.9.0 to 7.9.2
  • Added nl.jqno.equalsverifier:equalsverifier:3.19.4
  • Added org.apache.commons:commons-lang3:3.20.0
  • Added org.apache.kafka:kafka_2.13:3.9.2
  • Updated org.apache.mina:mina-core:2.2.4 to 2.2.8
  • Added org.apache.zookeeper:zookeeper:3.9.5
  • Added org.jacoco:org.jacoco.agent:0.8.14
  • Removed org.mockito:mockito-core:5.18.0
  • Added org.mockito:mockito-junit-jupiter:5.18.0
  • Removed org.scalatestplus:scalatestplus-mockito_2.13:1.0.0-SNAP5
  • Removed org.scalatest:scalatest_2.13:3.3.0-SNAP4

Plugin Dependency Updates

  • Removed com.diffplug.spotless:spotless-maven-plugin:2.44.4
  • Updated com.exasol:error-code-crawler-maven-plugin:2.0.5 to 2.0.7
  • Updated com.exasol:project-keeper-maven-plugin:5.4.3 to 5.6.2
  • Removed io.github.evis:scalafix-maven-plugin_2.13:0.1.10_0.11.0
  • Updated io.github.git-commit-id:git-commit-id-maven-plugin:9.0.2 to 10.0.0
  • Removed net.alchim31.maven:scala-maven-plugin:4.9.5
  • Updated org.apache.maven.plugins:maven-assembly-plugin:3.7.1 to 3.8.0
  • Updated org.apache.maven.plugins:maven-compiler-plugin:3.14.1 to 3.15.0
  • Added org.apache.maven.plugins:maven-dependency-plugin:3.10.0
  • Updated org.apache.maven.plugins:maven-failsafe-plugin:3.5.4 to 3.5.5
  • Updated org.apache.maven.plugins:maven-jar-plugin:3.4.2 to 3.5.0
  • Removed org.apache.maven.plugins:maven-javadoc-plugin:3.11.2
  • Updated org.apache.maven.plugins:maven-resources-plugin:3.3.1 to 3.5.0
  • Updated org.apache.maven.plugins:maven-surefire-plugin:3.5.4 to 3.5.5
  • Removed org.codehaus.mojo:exec-maven-plugin:3.5.0
  • Updated org.codehaus.mojo:versions-maven-plugin:2.19.1 to 2.21.0
  • Removed org.itsallcode:openfasttrace-maven-plugin:2.3.0
  • Removed org.scalastyle:scalastyle-maven-plugin:1.0.0
  • Removed org.scalatest:scalatest-maven-plugin:2.2.0
  • Updated org.sonarsource.scanner.maven:sonar-maven-plugin:5.2.0.4988 to 5.5.0.6356
Loading

1.7.16 Netty CVE fix

1.7.16 Netty CVE fix

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Oct 08:18
1.7.16
34d419c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release fixes several CVEs in transient dependencies.

Security

  • #151: CVE-2025-58057: io.netty:netty-codec-compression:jar:4.2.4.Final:test
  • CVE-2025-11226: CWE-20: Improper Input Validation (7.3) in ch.qos.logback:logback-core:jar:1.5.18:compile

Dependency Updates

Exasol Kafka Connector Extension

Compile Dependency Updates

  • Updated ch.qos.logback:logback-classic:1.5.18 to 1.5.20

Plugin Dependency Updates

  • Updated com.exasol:artifact-reference-checker-maven-plugin:0.4.3 to 0.4.4
  • Updated com.exasol:error-code-crawler-maven-plugin:2.0.4 to 2.0.5
  • Updated com.exasol:project-keeper-maven-plugin:5.2.3 to 5.4.3
  • Updated com.exasol:quality-summarizer-maven-plugin:0.2.0 to 0.2.1
  • Updated io.github.git-commit-id:git-commit-id-maven-plugin:9.0.1 to 9.0.2
  • Updated org.apache.maven.plugins:maven-artifact-plugin:3.6.0 to 3.6.1
  • Updated org.apache.maven.plugins:maven-clean-plugin:3.4.1 to 3.5.0
  • Updated org.apache.maven.plugins:maven-compiler-plugin:3.14.0 to 3.14.1
  • Updated org.apache.maven.plugins:maven-enforcer-plugin:3.5.0 to 3.6.2
  • Updated org.apache.maven.plugins:maven-failsafe-plugin:3.5.3 to 3.5.4
  • Updated org.apache.maven.plugins:maven-surefire-plugin:3.5.3 to 3.5.4
  • Updated org.codehaus.mojo:flatten-maven-plugin:1.7.0 to 1.7.3
  • Updated org.codehaus.mojo:versions-maven-plugin:2.18.0 to 2.19.1
  • Updated org.jacoco:jacoco-maven-plugin:0.8.13 to 0.8.14
  • Updated org.sonarsource.scanner.maven:sonar-maven-plugin:5.1.0.4751 to 5.2.0.4988
Loading

1.7.15 Fixes for vulnerabilities CVE-2025-1948 and CVE-2025-5115

1.7.15 Fixes for vulnerabilities CVE-2025-1948 and CVE-2025-5115

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Aug 11:54
1.7.15
69dae0c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release fixes the following vulnerabilities:

CVE-2025-5115 (CWE-400) in dependency org.eclipse.jetty.http2:http2-common:jar:9.4.57.v20241219:compile

In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory.

For example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal.
Per specification https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame.
The client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time.

The attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame.

Links:

CVE: CVE-2025-5115
CWE: CWE-400

References

CVE-2025-1948 (CWE-400) in dependency org.eclipse.jetty.http2:http2-common:jar:9.4.57.v20241219:compile

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE.
The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2025-1948 for details

CVE: CVE-2025-1948
CWE: CWE-400

References

Security

  • #148: Fixed vulnerability CVE-2025-5115 in dependency org.eclipse.jetty.http2:http2-common:jar:9.4.57.v20241219:compile
  • #147: Fixed vulnerability CVE-2025-1948 in dependency org.eclipse.jetty.http2:http2-common:jar:9.4.57.v20241219:compile

Dependency Updates

Exasol Kafka Connector Extension

Compile Dependency Updates

  • Updated org.eclipse.jetty.http2:http2-common:9.4.57.v20241219 to 9.4.58.v20250814
Loading

1.7.14 Fixed test dependencies

1.7.14 Fixed test dependencies

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Jul 08:55
1.7.14
a738985
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release updates dependencies to fix CVE-2025-53864 and CVE-2025-48924 in transitive test dependencies
com.google.code.gson:gson:jar:2.10.1:test and org.apache.commons:commons-lang3:jar:3.17.0:test respectively

Security

Dependency Updates

Exasol Kafka Connector Extension

Compile Dependency Updates

  • Added com.google.code.gson:gson:2.13.1

Test Dependency Updates

  • Updated com.exasol:exasol-testcontainers:7.1.4 to 7.1.7
  • Updated com.exasol:hamcrest-resultset-matcher:1.7.0 to 1.7.1
  • Updated com.exasol:test-db-builder-java:3.6.0 to 3.6.2
  • Updated org.mockito:mockito-core:5.17.0 to 5.18.0
  • Updated org.testcontainers:kafka:1.20.6 to 1.21.3

Plugin Dependency Updates

  • Updated com.exasol:error-code-crawler-maven-plugin:2.0.3 to 2.0.4
  • Updated com.exasol:project-keeper-maven-plugin:5.2.2 to 5.2.3
Loading

1.7.13 Fixed vulnerabilities

1.7.13 Fixed vulnerabilities

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Jul 15:14
1.7.13
97588ff
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release removes broken links from the readme.md file (start page).
This release fixes the following vulnerabilities:

CVE-2025-1948 (CWE: CWE-400) in dependency

org.eclipse.jetty.http2:http2-common:jar:9.4.57.v20241219:test
In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE.
The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

References

https://ossindex.sonatype.org/vulnerability/CVE-2025-1948?component-type=maven&component-name=org.eclipse.jetty.http2%2Fhttp2-common&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-1948GHSA-889j-63jv-qhr8

CVE-2025-27817 (CWE: CWE-918) in dependency org.apache.kafka:kafka-clients:jar:3.9.0:compile

A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products.

Since Apache Kafka 3.9.1/4.0.0, we have added a system property ("-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls") to set the allowed urls in SASL JAAS configuration. In 3.9.1, it accepts all urls by default for backward compatibility. However in 4.0.0 and newer, the default value is empty list and users have to set the allowed urls explicitly.

References

https://ossindex.sonatype.org/vulnerability/CVE-2025-27817?component-type=maven&component-name=org.apache.kafka%2Fkafka-clients&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-27817
https://access.redhat.com/security/cve/cve-2025-27817
https://www.openwall.com/lists/oss-security/2025/06/09/1

CVE-2025-27818 (CWE: CWE-502) in dependency org.apache.kafka:kafka-clients:jar:3.9.0:compile

A possible security vulnerability has been identified in Apache Kafka.
This requires access to a alterConfig to the cluster resource, or Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config
and a SASL-based security protocol, which has been possible on Kafka clusters since Apache Kafka 2.0.0 (Kafka Connect 2.3.0).
When configuring the broker via config file or AlterConfig command, or connector via the Kafka Kafka Connect REST API, an authenticated operator can set the sasl.jaas.config
property for any of the connector's Kafka clients to "com.sun.security.auth.module.LdapLoginModule", which can be done via the
producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or admin.override.sasl.jaas.config properties.
This will allow the server to connect to the attacker's LDAP server
and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server.
Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.

Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box
configurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector
client override policy that permits them.

Since Apache Kafka 3.9.1/4.0.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage
in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" are disabled in Apache Kafka Connect 3.9.1/4.0.0.

We advise the Kafka users to validate connector configurations and only allow trusted LDAP configurations. Also examine connector dependencies for
vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally,
in addition to leveraging the "org.apache.kafka.disallowed.login.modules" system property, Kafka Connect users can also implement their own connector
client config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.

Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2025-27818 for details

References

https://ossindex.sonatype.org/vulnerability/CVE-2025-27818?component-type=maven&component-name=org.apache.kafka%2Fkafka-clients&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2025-27818
GHSA-76qp-h5mr-frr4

CVE-2025-48734 (CWE-284) in dependency commons-beanutils:commons-beanutils:jar:1.9.4:provided

commons-beanutils - Improper Access Control

References

Features

  • #140: Remove broken links from start page

Security

  • #139: Fixed vulnerability CVE-2025-48734 in dependency commons-beanutils:commons-beanutils:jar:1.9.4:provided
  • #141: Fixed vulnerability CVE-2025-27817 in dependency org.apache.kafka:kafka-clients:jar:3.9.0:compile
  • #142: Fixed vulnerability CVE-2025-27818 in dependency org.apache.kafka:kafka-clients:jar:3.9.0:compile
  • #138: Fixed vulnerability CVE-2025-1948 in dependency org.eclipse.jetty.http2:http2-common:jar:9.4.57.v20241219:test

Dependency Updates

Exasol Kafka Connector Extension

Compile Dependency Updates

  • Updated org.apache.kafka:kafka-clients:3.9.0 to 3.9.1
  • Added org.eclipse.jetty.http2:http2-common:9.4.57.v20241219

Plugin Dependency Updates

  • Updated com.exasol:project-keeper-maven-plugin:5.0.0 to 5.2.2
  • Added io.github.git-commit-id:git-commit-id-maven-plugin:9.0.1
  • Removed io.github.zlika:reproducible-build-maven-plugin:0.17
  • Added org.apache.maven.plugins:maven-artifact-plugin:3.6.0
  • Updated org.apache.maven.plugins:maven-failsafe-plugin:3.5.2 to 3.5.3
  • Updated org.apache.maven.plugins:maven-surefire-plugin:3.5.2 to 3.5.3
  • Updated org.jacoco:jacoco-maven-plugin:0.8.12 to 0.8.13
  • Updated org.sonarsource.scanner.maven:sonar-maven-plugin:5.0.0.4389 to 5.1.0.4751
Loading

1.7.12 Update libraries

1.7.12 Update libraries

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Apr 09:50
1.7.12
0b19c97
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release updates several dependencies to fix CVE-2024-56128, CVE-2024-55551 and CVE-2024-58103 in test dependencies.
It also updates kafka client libraries to version 3.9

Refactoring

  • #103: Upgrade to recent dependencies breaks tests

Security

Dependency Updates

Exasol Kafka Connector Extension

Compile Dependency Updates

  • Updated ch.qos.logback:logback-classic:1.5.16 to 1.5.18
  • Removed com.fasterxml.jackson.core:jackson-core:2.18.2
  • Removed com.google.guava:guava:33.4.0-jre
  • Updated io.confluent:kafka-avro-serializer:7.7.1 to 7.9.0
  • Removed org.apache.avro:avro:1.12.0
  • Removed org.apache.commons:commons-compress:1.27.1
  • Updated org.apache.kafka:kafka-clients:3.7.2 to 3.9.0
  • Updated org.scala-lang.modules:scala-collection-compat_2.13:2.12.0 to 2.13.0
  • Updated org.scala-lang:scala-library:2.13.15 to 2.13.16
  • Updated org.slf4j:slf4j-api:2.0.16 to 2.0.17

Test Dependency Updates

  • Updated com.exasol:exasol-testcontainers:7.1.2 to 7.1.4
  • Updated com.exasol:extension-manager-integration-test-java:0.5.13 to 0.5.16
  • Removed com.google.protobuf:protobuf-java:4.29.3
  • Updated io.confluent:kafka-streams-avro-serde:7.7.1 to 7.9.0
  • Removed io.github.classgraph:classgraph:4.8.179
  • Updated io.github.embeddedkafka:embedded-kafka-schema-registry_2.13:7.7.2 to 7.9.0
  • Removed org.hibernate.validator:hibernate-validator:6.2.5.Final
  • Updated org.mockito:mockito-core:5.14.2 to 5.17.0
  • Updated org.testcontainers:kafka:1.20.3 to 1.20.6

Plugin Dependency Updates

  • Updated com.diffplug.spotless:spotless-maven-plugin:2.43.0 to 2.44.4
  • Updated com.exasol:artifact-reference-checker-maven-plugin:0.4.2 to 0.4.3
  • Updated com.exasol:project-keeper-maven-plugin:4.5.0 to 5.0.0
  • Updated net.alchim31.maven:scala-maven-plugin:4.9.2 to 4.9.5
  • Updated org.apache.maven.plugins:maven-clean-plugin:3.4.0 to 3.4.1
  • Updated org.apache.maven.plugins:maven-compiler-plugin:3.13.0 to 3.14.0
  • Updated org.apache.maven.plugins:maven-install-plugin:3.1.3 to 3.1.4
  • Updated org.apache.maven.plugins:maven-javadoc-plugin:3.11.1 to 3.11.2
  • Updated org.codehaus.mojo:flatten-maven-plugin:1.6.0 to 1.7.0

Extension

Compile Dependency Updates

  • Updated @exasol/extension-manager-interface:0.4.3 to 0.5.0

Development Dependency Updates

  • Updated eslint:9.18.0 to 9.22.0
  • Updated ts-jest:^29.2.5 to ^29.2.6
  • Added @types/jest:^29.5.14
  • Updated typescript-eslint:^8.20.0 to ^8.26.0
  • Updated typescript:^5.7.3 to ^5.8.2
  • Updated esbuild:^0.24.2 to ^0.25.1
  • Removed @jest/globals:^29.7.0
  • Removed @types/node:^22.10.6
Loading

1.7.11 Fixed CVE-2025-24970 and CVE-2025-25193

1.7.11 Fixed CVE-2025-24970 and CVE-2025-25193

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Feb 12:20
1.7.11
1a28d07
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This update fixes CVE-2025-24970 and CVE-2025-25193 in transitive netty dependency used in test code.

Security

Dependency Updates

Exasol Kafka Connector Extension

Test Dependency Updates

  • Removed io.netty:netty-codec:4.1.115.Final
Loading

1.7.10 Security fixes in transitive dependencies

1.7.10 Security fixes in transitive dependencies

Choose a tag to compare

View all tags
@github-actions github-actions released this 15 Jan 13:27
1.7.10
632c655
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixes several security issues in transitive dependencies: CVE-2024-56128, CVE-2024-12798, CVE-2024-12801 and CVE-2024-52046.
Project keeper was upgraded to the latest version.

Security

Dependency Updates

Exasol Kafka Connector Extension

Compile Dependency Updates

  • Updated ch.qos.logback:logback-classic:1.5.12 to 1.5.16
  • Updated com.fasterxml.jackson.core:jackson-core:2.18.1 to 2.18.2
  • Updated com.google.guava:guava:33.3.1-jre to 33.4.0-jre
  • Updated org.apache.kafka:kafka-clients:3.7.1 to 3.7.2

Test Dependency Updates

  • Updated com.exasol:exasol-testcontainers:7.1.1 to 7.1.2
  • Updated com.exasol:maven-project-version-getter:1.2.0 to 1.2.1
  • Updated com.google.protobuf:protobuf-java:4.28.3 to 4.29.3
  • Updated io.github.embeddedkafka:embedded-kafka-schema-registry_2.13:7.7.1 to 7.7.2
  • Added org.apache.mina:mina-core:2.2.4

Plugin Dependency Updates

  • Updated com.exasol:project-keeper-maven-plugin:4.4.0 to 4.5.0
  • Updated org.apache.maven.plugins:maven-failsafe-plugin:3.5.1 to 3.5.2
  • Updated org.apache.maven.plugins:maven-site-plugin:3.9.1 to 3.21.0
  • Updated org.apache.maven.plugins:maven-surefire-plugin:3.5.1 to 3.5.2
  • Updated org.codehaus.mojo:versions-maven-plugin:2.17.1 to 2.18.0
  • Updated org.sonarsource.scanner.maven:sonar-maven-plugin:4.0.0.4121 to 5.0.0.4389

Extension

Development Dependency Updates

  • Updated eslint:9.14.0 to 9.18.0
  • Updated @types/node:^22.9.1 to ^22.10.6
  • Updated typescript-eslint:^8.14.0 to ^8.20.0
  • Updated typescript:^5.6.3 to ^5.7.3
  • Updated esbuild:^0.24.0 to ^0.24.2
Loading

1.7.9 Fixed vulnerabilities CVE-2024-47535 and CVE-2023-1932

1.7.9 Fixed vulnerabilities CVE-2024-47535 and CVE-2023-1932

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Nov 15:58
1.7.9
6da3096
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release fixes the following vulnerability:

CVE-2024-47535 (CWE-400) in dependency io.netty:netty-common:jar:4.1.108.Final:test

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.

References

CVE-2023-1932 (CWE-79) in dependency org.hibernate.validator:hibernate-validator:jar:6.1.7.Final:test

A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.

References

Security

  • #118: Fixed vulnerability CVE-2024-47535 in dependency io.netty:netty-common:jar:4.1.108.Final:test
  • #116: Fixed vulnerability CVE-2023-1932 in dependency org.hibernate.validator:hibernate-validator:jar:6.1.7.Final:test

Dependency Updates

Exasol Kafka Connector Extension

Compile Dependency Updates

  • Updated ch.qos.logback:logback-classic:1.5.6 to 1.5.12
  • Added com.exasol:import-export-udf-common-scala:2.0.1
  • Removed com.exasol:import-export-udf-common-scala_2.13:2.0.0
  • Updated com.fasterxml.jackson.core:jackson-core:2.17.0 to 2.18.1
  • Updated com.google.guava:guava:33.1.0-jre to 33.3.1-jre
  • Updated org.apache.avro:avro:1.11.4 to 1.12.0
  • Updated org.apache.commons:commons-compress:1.26.1 to 1.27.1
  • Updated org.scala-lang.modules:scala-collection-compat_2.13:2.11.0 to 2.12.0
  • Updated org.scala-lang:scala-library:2.13.12 to 2.13.15

Test Dependency Updates

  • Updated com.exasol:extension-manager-integration-test-java:0.5.10 to 0.5.13
  • Updated com.exasol:hamcrest-resultset-matcher:1.6.5 to 1.7.0
  • Added com.exasol:maven-project-version-getter:1.2.0
  • Updated com.exasol:test-db-builder-java:3.5.4 to 3.6.0
  • Updated com.google.protobuf:protobuf-java:3.25.5 to 4.28.3
  • Updated io.github.classgraph:classgraph:4.8.174 to 4.8.179
  • Added io.netty:netty-codec:4.1.115.Final
  • Removed org.eclipse.jetty:jetty-http:9.4.56.v20240826
  • Removed org.eclipse.jetty:jetty-server:9.4.56.v20240826
  • Removed org.eclipse.jetty:jetty-servlets:9.4.56.v20240826
  • Added org.hibernate.validator:hibernate-validator:6.2.5.Final
  • Updated org.mockito:mockito-core:5.11.0 to 5.14.2
  • Updated org.testcontainers:kafka:1.19.7 to 1.20.3

Plugin Dependency Updates

  • Updated io.github.evis:scalafix-maven-plugin_2.13:0.1.8_0.11.0 to 0.1.10_0.11.0
  • Updated net.alchim31.maven:scala-maven-plugin:4.8.1 to 4.9.2
  • Updated org.apache.maven.plugins:maven-javadoc-plugin:3.6.3 to 3.11.1
  • Updated org.codehaus.mojo:exec-maven-plugin:3.2.0 to 3.5.0
  • Updated org.itsallcode:openfasttrace-maven-plugin:2.0.0 to 2.3.0

Extension

Compile Dependency Updates

  • Updated @exasol/extension-manager-interface:0.4.1 to 0.4.3

Development Dependency Updates

  • Updated eslint:^8.57.0 to 9.14.0
  • Updated @types/node:^20.11.28 to ^22.9.1
  • Updated ts-jest:^29.1.2 to ^29.2.5
  • Added typescript-eslint:^8.14.0
  • Updated typescript:^5.4.2 to ^5.6.3
  • Updated esbuild:^0.20.2 to ^0.24.0
  • Removed @typescript-eslint/parser:^7.2.0
  • Removed @typescript-eslint/eslint-plugin:^7.2.0
Loading