# Vulnerable 3rd party jars found in dremio 24.2.6

**URL:** <https://community.dremio.com/t/vulnerable-3rd-party-jars-found-in-dremio-24-2-6/11405>\
**Category:** Uncategorized\
**Created:** [January 18, 2024, 5:05am UTC](https://community.dremio.com/t/vulnerable-3rd-party-jars-found-in-dremio-24-2-6/11405 "2024-01-18T05:05:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![abkul](https://avatars.discourse-cdn.com/v4/letter/a/7feea3/32.png) [@abkul](https://community.dremio.com/u/abkul)\
**Post date:** [January 18, 2024, 5:05am UTC](https://community.dremio.com/t/vulnerable-3rd-party-jars-found-in-dremio-24-2-6/11405/1 "2024-01-18T05:05:27Z")

</div>

Hi Team,  
We have found a few vulnerable 3rd party components in docker Image: dremio:24.2.6 Is there any timeline for when we can have the updated jars in the image?

Below is the list of jars that we have found to be vulnerable.

1. protobuf-java fixed in 3.19.6 or above  
/opt/dremio/jars/3rdparty/hadoop-shaded-protobuf\_3\_7-1.1.1.jar(3.7.1)

[nvd.nist.gov/vuln/detail/CVE-2022-3510](http://nvd.nist.gov/vuln/detail/CVE-2022-3510)  
CVSS Base Score: 7.5 High

1. jetty-http, jetty-server, jetty-util, jetty-webapp, jetty-servlets, jetty-io and jetty-client 9.4.51.v20230217 fixed in 9.4.53.v20231009 or above  
/opt/dremio/jars/3rdparty/jetty-\*-9.4.51.v20230217.jar

CVE-2023-36478  
CVSS Base Score: 7.5 High

1. pf4j fixed in 3.10.0 or above  
/opt/dremio/jars/3rdparty/pf4j-3.6.0.jar

CVE-2023-40828  
CVSS Base Score: 7.5 High

1. guava fixed in 32.1.1-jre  
/opt/dremio/jars/3rdparty/dremio-twill-shaded-24.2.6-202311250456170399-68acbe47.jar(13.0.1)  
/opt/dremio/jars/3rdparty/iceberg-bundled-guava-1.3.0-7dbdfd3-20230614154222-545fbe0.jar(31.1-jre)  
/opt/dremio/jars/3rdparty/gcs-connector-hadoop3-2.2.2-dremio-202306291124120084-8ab9811-shaded.jar(30.1-jre)  
/opt/dremio/jars/3rdparty/hadoop-shaded-guava-1.1.1.jar(30.1.1-jre)

CVE-2023-2976  
CVSS Base Score: 7.1 High

1. elasticsearch 6.8.23 fixed in 8.11.1  
/opt/dremio/jars/3rdparty/elasticsearch-6.8.23.jar

CVE-2023-31418  
CVSS Base Score: 7.5 High

1. okio 3.2.0 fixed in 3.4.0 or above  
/opt/dremio/jars/3rdparty/okio-3.2.0.jar

CVE-2023-3635  
CVSS Base Score: 7.5 High

1. libthrift 0.13.0 fixed in 0.14.0 or above  
/opt/dremio/jars/3rdparty/libthrift-0.13.0.jar

CVE-2020-13949  
CVSS Base Score: 7.5 High

regards  
abkul

---

<div class="post-metadata">

**Author:** ![isha](https://sea2.discourse-cdn.com/flex020/user_avatar/community.dremio.com/isha/32/2883_2.png) [@isha](https://community.dremio.com/u/isha)\
**Post date:** [January 18, 2024, 7:11pm UTC](https://community.dremio.com/t/vulnerable-3rd-party-jars-found-in-dremio-24-2-6/11405/2 "2024-01-18T19:11:10Z")

</div>

We take security issues very seriously at Dremio. If there is an exploitable security issue, we resolve them within our internal security SLAs based on severity/priority. In case of non exploitable security issues for the third party libraries, we always try to update it to the latest possible version at a regular cadence. Please always update to the latest Dremio version if possible.

For more information about security at Dremio: [Platform Security - Protecting Your Data | Dremio](https://www.dremio.com/platform/security/)

For more information about recent security vulnerabilities: [Security Bulletins | Dremio Documentation](https://docs.dremio.com/current/reference/bulletins/)