When Version 3.7.0 Release

[stevanusc6]

Hi there, I just wonder when the version 3.7.0 will release?

I need the fixing vulnerable CVE-2024-47535, and CVE-2024-12798 on my project.

Thankyou

[jeanbisutti]

The next release will be in January.

[jgprogram]

I wanted to inquire about the current release process and frequency for this project. Specifically, is there any possibility of increasing the frequency of releases, at least to include versions with dependency upgrades?

For instance, the latest release (v3.6.2) was published on October 31, 2024. Since then, more than a month has passed, during which several open vulnerabilities in the dependencies have been identified. Unfortunately, similar situations have occurred with previous versions.

Would it be feasible to adopt a more regular release schedule, particularly focusing on delivering patches or minor updates to address vulnerabilities and dependency upgrades?

[trask]

hi @jgprogram, we have automation to alert us immediately of CVEs reported in all of our dependencies, and we check those CVEs to ensure they aren't exploitable (given that we shade them in to the Java agent).

if there is an exploitable vulnerability, we release a patch immediately.

if it's not exploitable, we roll it into our monthly release (we do understand that scanners can be quite noisy about these things)

our release cadence is monthly (specifically the week after the upstream OpenTelemetry Java agent is released).

unfortunately we were under a critical change only advisory for Nov, Dec, and early Jan, and so could not make releases during that time unless there happened to be an exploitable vulnerability.

[josephShield]

@trask , does that mean the current latest version (3.6.2) is NOT exploitable to the various high-CVE dependencies identified as dependencies of AppInsights agent?

I'm here because I'm trying to shade/shadowjar our own construction of applicationinsights-agent-3.6.2 but with forced upgrades of various transitive dependencies that are vulnerable, apache mina, logback, jetty to name a few. That seemed easier than digging into your source code to figure out if you were vulnerable to the specific logback CVE, repeat for each vulnerability, but even then I'm running into issues with the Spring classloader.

Hearing that 3.6.2 ISN'T vulnerable to the numerous (70) vulnerabilities identified by my Checkmarx scanner would absolutely make my week

[trask]

(I need to clarify one thing above, which is that our threshold for patching immediately are vulnerabilities with CVSS scoring of 7.0 or higher)

[trask]

does that mean the current latest version (3.6.2) is NOT exploitable to the various high-CVE dependencies identified as dependencies of AppInsights agent?

@josephShield we're only seeing these CVEs against 3.6.2:

• CVE-2024-12801
• CVE-2024-47535
• CVE-2024-12798

none of which are High

can you give us more details about what you're seeing?

[josephShield]

Unfortunately Checkmarx's exported output doesn't also include the CVE issue, and yet their UI doesn't also show the source of the transitive dependency. Above is a screenshot of the former, the raw output.

Here I've manually compared each identified vulnerability with the respective CVE(s) (in red), at least for the 9.0 and above ones. As you can see (in yellow) there are 50 vulnerabilities of 7.0 and above

And in copied form for ease of search:
CVE-2024-52046
CVE-2017-5929
CVE-2017-5929
CVE-2020-10683
CVE-2017-7657
CVE-2017-7657
CVE-2016-4800
CVE-2015-4852, CVE-2015-7501, CVE-2016-2170
CVE-2020-10683
CVE-2017-1000190

Perhaps I'm misreading my Checkmarx output if you're not seeing any of these?

[trask]

it looks like you may be having same issue as open-telemetry/opentelemetry-java-instrumentation#13000

we should follow suit in this repo and exclude Exclude META-INF/maven from shaded libraries