Package
strimzi-kafka-operator-fips-kafka-agent
Component
vertx-core
Latest update
Fixed version
1.1.0-r0
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
1.1.0-r0Status
Status
Impact
The vulnerable component is the Maven artifact io.vertx:vertx-core. Per the GitHub Security Advisory at https://github.com/advisories/GHSA-3g76-f9xq-8vp6, every affected version range listed for io.vertx:vertx-core (covering the 4.3.x, 4.4.x, 4.5.x and 5.0.x release lines, including 5.0.7 that strimzi-kafka-operator-fips ships) is declared as affected with no firstPatchedVersion. Without an upstream patched release of io.vertx:vertx-core, this issue cannot be closed by routine dependency-bump automation. A pending-upstream-fix advisory event is justified: the issue should reflect that we are awaiting upstream Eclipse Vert.x maintainers to publish a fixed release on at least one of the supported branches.
Status