Refactored because of deprecation of TopicPartitionCounter. Moved functionality to flush. Fixes #43.

[jcustenborder]

No description provided.

[sonatype-lift]

Critical OSS Vulnerability:

pkg:maven/com.github.jcustenborder.kafka.connect/connect-utils-jackson@0.7.171

2 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 2 dependencies

Components

pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.1

CRITICAL Vulnerabilities (2)




CVE-2020-36518

[CVE-2020-36518] CWE-787: Out-of-bounds Write

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

CVSS Score: 7.5

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-787

sonatype-2021-4682

[sonatype-2021-4682] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

jackson-databind - Denial of Service (DoS)

The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

CVSS Score: 7.5

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-400

pkg:maven/com.google.guava/guava@30.1.1-jre

SEVERE Vulnerabilities (1)




[sonatype-2020-0926] CWE-379: Creation of Temporary File in Directory with Incorrect Permissions

guava - Creation of Temporary File in Directory with Insecure Permissions [CVE-2020-8908]

The software creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

CVSS Score: 6.2

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-379

(at-me in a reply with help or ignore)

---

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]