Upgrade transitive Avro dependency resolved by spring-cloud-stream-binder-kinesis 4.0.6

[prjain96]

Hi team,

We are using:

org.springframework.cloud:spring-cloud-stream-binder-kinesis:4.0.6

In our project, the dependency tree shows that the binder resolves Apache Avro 1.11.3 transitively through the following path:

ie.xxxxxxxxxx:0.1.0-SNAPSHOT
- org.springframework.cloud:spring-cloud-stream-binder-kinesis:4.0.6
- software.amazon.kinesis:amazon-kinesis-client:2.5.8
- software.amazon.glue:schema-registry-common:1.1.19
- org.apache.avro:avro:1.11.3

Apache Avro 1.11.3 is affected by CVE-2024-47561, and the published guidance recommends upgrading to 1.11.4 or 1.12.0.

Because spring-cloud-stream-binder-kinesis 4.0.6 is currently the latest binder release available to us, would you consider updating the managed dependency chain so that the binder no longer resolves Avro 1.11.3 by default?

I am intentionally not prescribing the exact implementation, since this may be addressed by:

• upgrading amazon-kinesis-client,
• upgrading software.amazon.glue:schema-registry-common, or
• overriding/pinning org.apache.avro:avro to a fixed version in dependency management.

For reference, we identified this with:
mvn dependency:tree -Dincludes=org.apache.avro:avro

Thanks.

[MatejNedic]

Hey @prjain96 ,

Please note that the spring-cloud-stream-binder-kinesis project was originally developed under the Spring umbrella as a standalone project, separate from Spring Cloud AWS.

However, starting with Spring Cloud AWS 4.0.0, both Spring AWS Integrations and the Kinesis Binder were consolidated into the Spring Cloud AWS repository. More details about this transition are available in the Spring Integration AWS EOL.

Spring Cloud AWS 4.0.2 uses amazon-kinesis-client version 3.1.2, which introduces Apache Avro 1.11.4 as a transitive dependency via the AWS Glue Schema Registry. There are plans to upgrade the Kinesis Client to the latest 3.4.x release in Spring Cloud AWS 4.1.0, which is expected to bring in a newer version of Apache Avro as well.

Please check Spring Cloud AWS 4.0.2 Kinesis Binder.

Hope this helps :)

[MatejNedic]

@prjain96
I will close this ticket since we have nothing to do here. Please if you have any question reopen it and write a message.