[bitnami/schema-registry] Critical & High Security Finding in Schema-Registry - MiniZip | Zlib

[aymenwerg]

Name and Version

bitnami/schema-registry:7.7.1

What architecture are you using?

amd64

What steps will reproduce the bug?

Hi,
We are using the Bitnami Schema Registry in the AWS Cloud. The AWS ECR Image Scan has detected critical vulnerabilities, specifically CVE-2023-45853 (https://security-tracker.debian.org/tracker/CVE-2023-45853).

This issue affects all versions from 7.3 to 7.7.1, and unfortunately, this security finding has not been resolved for 1.5 years. Are there plans to patch this in the next versions?

What is the expected behavior?

No High or Critical findings

What do you see instead?

Critical findings
Vulnerable package: zlib::1:1.2.13.dfsg-1
Description: MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.

[carrodher]

I understand your concern about security vulnerabilities. We regularly update our images with the latest system packages; however, certain CVEs may persist until they are patched in the OS or application. Additionally, some CVEs remain unfixed due to the absence of available patches. In vulnerability scanners like Trivy, you can use the --ignore-unfixed flag to ignore such CVEs. You can learn more about our CVE policy here.

The Bitnami Application Catalog (OpenSource) is built on Debian 12. Additionally, as part of VMware, Bitnami offers a custom container and Helm Charts catalog based on various base images, such as Debian 11 & 12, PhotonOS 5, Ubuntu 22.04 & 24.04, RedHat UBI 8 & 9, and custom golden images. You can explore these options through the VMware Tanzu Application Catalog.

If you have any further questions, feel free to ask.

[github-actions]

This Issue has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thanks for the feedback.