Multiple OS vulnerabilities found in jmx_expoter version 0.15.0

[KunalAdu]

trafficstars

Hi Team ,

Below OS related CVEs are found in jmx_expoter version 0.15.0 , Can you please guide in which version it will be fixed :

1. CVE-2018-12886
2. CVE-2020-6096
3. CVE-2019-17543
4. CVE-2019-17498
5. CVE-2019-13115

As these are quite old issues and are not fixed yet, Can you please give any update or time line.

Thanks & Regards, Kunal Advani

[fstab]

Hi Kunal, I looked up a few of these, but I can't really see how they are related to the jmx_exporter. Are these vulnerabilities in the JAR file, or is it a JVM or a Docker image?

[KunalAdu]

Hi @fstab , we have used docker image . Please find below configuration : { "image": "bitnami/jmx-exporter", "imageTag":"0.15.0" }

[fstab]

Looks like Bitnami pushed a new image with the 0.15.0 tag today. Could you check if the CVEs are still there? If so, I think this should more be an issue on github.com/bitnami/bitnami-docker-jmx-exporter if the CVEs come from the Docker image and not from the jmx_exporter itself.

[KunalAdu]

@fstab : Thank you so much I will check on it .

[dhoard]

Closing as no longer valid (old release.)