7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
This advisory's component path (/usr/share/java/hono-cli/hono-cli.jar) does not exist in the hono package. The base hono package installs no files beyond standard package metadata; the affected jline-builtins component is only present in the hono-cli subpackage, which is tracked separately for this vulnerability.
Status
Impact
Eclipse Hono's CLI module constructs org.jline.builtins.ConfigurationPath with two null arguments. jline-builtins 3.30.2 and later — including the 3.30.15 release that carries the fix for this vulnerability — add a second ConfigurationPath(String, Path) constructor overload alongside the original ConfigurationPath(Path, Path) one, which makes that call ambiguous and fails to compile. Adopting a fixed jline-builtins release therefore requires an accompanying source change in Eclipse Hono's CLI to disambiguate the constructor call; upstream has not yet made this change. Tracking for an Eclipse Hono release that resolves this so the fixed jline-builtins version can be adopted.
Status