Various CVEs present in 3.27.4.1 version of quarkus. Need a timeline on the release plan of those.

[jeejz]

Hi Quarkus Team, We are using 3.27.4.1 version of Quarkus in our project and we could see that multiple vulnerabilities present for this version in our scans.

We are looking forward for the timeline on the list of CVEs as marked in the mvn repository, and also as per the details in my mail.

[sberyozkin]

@jeejz We recommend to discuss CVEs at security@quarkus.io, please forward your queries to that email address

[jeejz]

I have already send that mail, but didn't got any acknowledgement or reply to that.

[sberyozkin]

@jeejz When did you send it ? Please retry

[jeejz]

on 17th July, 5:35PM IST. I had resend it now. Please confirm whether you have received it.

[jeejz]

Hope we can track the CVE details through mail. I have removed it from this discussion.

[sberyozkin]

Thanks @jeejz Confirm the email came through, we actually had a transient problem last week which is why I asked when you sent it.

In general, as far as public CVEs are concerned, users are going to continue reporting them publicly in Quarkus, I suppose they are in the public domain after all. It makes sense though whenever some significant number of CVEs is discussed, to discuss them at the dedicated security list