CVE-2024-6345 in cp-kafka:7.4.6 images (RHEL)

[nemobis]

The trivy scanner finds one potential vulnerability in the most recent 7.4.x image, 7.4.6 (same on cp-schema-registry:7.4.6, cp-server:7.4.6, cp-zookeeper:7.4.6).

2024-09-11T11:07:49Z	INFO	Detected OS	family="redhat" version="8.10"
2024-09-11T11:07:49Z	INFO	[redhat] Detecting RHEL/CentOS vulnerabilities...	os_version="8" pkg_num=175
2024-09-11T11:07:49Z	INFO	Number of language-specific files	num=2
2024-09-11T11:07:49Z	INFO	[python-pkg] Detecting vulnerabilities...
2024-09-11T11:07:49Z	INFO	[jar] Detecting vulnerabilities...
2024-09-11T11:07:49Z	WARN	Using severities from other vendors for some vulnerabilities. Read https://aquasecurity.github.io/trivy/v0.53/docs/scanner/vulnerability#severity-selection for details.
2024-09-11T11:07:49Z	INFO	Table result includes only package filenames. Use '--format json' option to get the full path to the package file.

cp-kafka:7.4.6.tar (redhat 8.10)
================================
Total: 2 (HIGH: 2, CRITICAL: 0)

┌────────────────────────────┬───────────────┬──────────┬────────┬───────────────────┬─────────────────┬─────────────────────────────────────────────────────┐
│          Library           │ Vulnerability │ Severity │ Status │ Installed Version │  Fixed Version  │                        Title                        │
├────────────────────────────┼───────────────┼──────────┼────────┼───────────────────┼─────────────────┼─────────────────────────────────────────────────────┤
│ platform-python-setuptools │ CVE-2024-6345 │ HIGH     │ fixed  │ 39.2.0-7.el8      │ 39.2.0-8.el8_10 │ pypa/setuptools: Remote code execution via download │
│                            │               │          │        │                   │                 │ functions in the package_index module in...         │
│                            │               │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2024-6345           │
├────────────────────────────┤               │          │        │                   │                 │                                                     │
│ python3-setuptools-wheel   │               │          │        │                   │                 │                                                     │
│                            │               │          │        │                   │                 │                                                     │
│                            │               │          │        │                   │                 │                                                     │
└────────────────────────────┴───────────────┴──────────┴────────┴───────────────────┴─────────────────┴─────────────────────────────────────────────────────┘

[winfriedgerlach]

Issue was fixed in CP 7.7.1.
@nemobis @janjwerner-confluent can we close this issue?

[nemobis]

Thanks. I've not tested the new version but I guess so!