Potential security vulnerability in the zstd C library.

[HelenParr]

Hi, @sullis , @eudes , I'd like to report a vulnerability issue in com.tersesystems.logback:logback-compress-encoder:1.0.2.

Issue Description

I noticed that com.tersesystems.logback:logback-compress-encoder:1.0.2 directly depends on com.github.luben:zstd-jni:v1.4.0-1 in the pom. However, as shown in the following dependency graph. However, com.github.luben:zstd-jni:v1.4.0-1 sufferes from the vulnerability which the C library zstd(version:1.4.0) exposed: CVE-2021-24031.

Dependency Graph between Java and Shared Libraries

Suggested Vulnerability Patch Versions

com.github.luben:zstd-jni:v1.4.9-1 (>=v1.4.9-1) has upgraded this vulnerable C library zstd to the patch version 1.4.9.

Java build tools cannot report vulnerable C libraries, which may induce potential security issues to many downstream Java projects. Could you please upgrade this vulnerable dependency?

Thanks for your help~
Best regards,
Helen Parr

[wsargent]

Fixed by https://github.com/tersesystems/terse-logback/releases/tag/v1.0.3