What is the process for vulnerability remediation?

[JKaulback]

The latest release of cucumber-spring has a transitive vulnerability with one of its dependencies: messages-ndjson > jackson

My team is waiting on a fix for this, just wondering about the process for fixing vulnerabilities and if there is a timeline that I can bring back to my team.

[laeubi]

My team is waiting on a fix for this

So instead of waiting have you taken actions to actually providing a PR or similar?
Have you at least investigated if the problematic code path is ever hit by cucumber?
What prevents you from simply updating the dependency to whatever version you find better suited?

[JKaulback]

We're waiting because there is currently no fix.

We use maven for building so we manage the dependencies that way, but forcing the fixed version of jackson breaks the builds & excluding the dependency with the vulnerability also breaks the builds.

We have plenty of other issues to work on. I'm unfamiliar with the cucumber code base, we just use it for testing. Thanks for the suggestions though, we have tried all we can (at least everything we can think of) on our end.

[mpkorstanje]

@JKaulback It depends. You can always email security@cucumber.io. Though for problems that already have a CVE creating an issue against https://github.com/cucumber/messages-ndjson would the most efficient approach.

[mpkorstanje]

I just saw your email. The spam filter ate it. I'll take a look.

[JKaulback]

Thank you. I don't remember sending an email, so someone else may have had the same issue.

From what I've seen, the fix might not be trivial. The latest messages-ndjson version has breaking changes when used with cucumber-spring, but 0.4.x seems to work (cucumber-spring currently uses 0.3.x)

[mpkorstanje]

Ah. My bad. It was a very similar name.

Anyway. Yeah it is not a trivial fix. I'm in the middle of finishing v8 of Cucumber JVM. But I can patch the v0.3.x and v7.x.x branches of messages-ndjson and cucumber-jvm. Should be available once https://github.com/cucumber/cucumber-jvm/releases/tag/v7.34.5 reaches Maven Central.