CGA-gq2h-jcxq-3ff4

This vulnerability affects logback-core, a transitive dependency brought in via amazon-kinesis-client-python (amazon-kclpy). The fix version of logback-core does not exist in amazon-kclpy at the most recent version v3.1.2. The amazon-kclpy maintainers must implement the logback-core update in a future release before this vulnerability can be resolved in localstack. Reference: https://github.com/awslabs/amazon-kinesis-client-python/blob/8fb5e024c48d0915e16e2ffb25d044359a81e848/pom.xml#L10