From 402cf9b5aafd75f11017afcfee263b037feaeeba Mon Sep 17 00:00:00 2001 From: Sergey Matvienko Date: Fri, 13 Jun 2025 14:13:01 +0200 Subject: [PATCH 1/8] CVE-2025-49146 postgresql.driver 4.7.5 -> 4.7.7 --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 0260dc09be..5093c19435 100755 --- a/pom.xml +++ b/pom.xml @@ -103,7 +103,7 @@ 1.19.0 1.78.1 2.0.1 - 42.7.5 + 42.7.7 org/thingsboard/server/gen/**/*, org/thingsboard/server/extensions/core/plugin/telemetry/gen/**/* From 6e4ee1eb44a049cf401b51c66bf469bf61f721d0 Mon Sep 17 00:00:00 2001 From: Sergey Matvienko Date: Fri, 13 Jun 2025 14:46:10 +0200 Subject: [PATCH 2/8] CVE-2025-27817 kafka client 3.7.2 -> 3.9.1 (NetworkReceive.java has no code changes in the Kafka upstream) --- .../java/org/apache/kafka/common/network/NetworkReceive.java | 4 ++-- pom.xml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/application/src/main/java/org/apache/kafka/common/network/NetworkReceive.java b/application/src/main/java/org/apache/kafka/common/network/NetworkReceive.java index 80192520ca..88a03f5fc8 100644 --- a/application/src/main/java/org/apache/kafka/common/network/NetworkReceive.java +++ b/application/src/main/java/org/apache/kafka/common/network/NetworkReceive.java @@ -103,13 +103,13 @@ public class NetworkReceive implements Receive { if (maxSize != UNLIMITED && receiveSize > maxSize) { throw new ThingsboardKafkaClientError("Invalid receive (size = " + receiveSize + " larger than " + maxSize + ")"); } - requestedBufferSize = receiveSize; //may be 0 for some payloads (SASL) + requestedBufferSize = receiveSize; // may be 0 for some payloads (SASL) if (receiveSize == 0) { buffer = EMPTY_BUFFER; } } } - if (buffer == null && requestedBufferSize != -1) { //we know the size we want but havent been able to allocate it yet + if (buffer == null && requestedBufferSize != -1) { // we know the size we want but haven't been able to allocate it yet if (requestedBufferSize > TB_LOG_REQUESTED_BUFFER_SIZE) { String stackTrace = Arrays.stream(Thread.currentThread().getStackTrace()).map(StackTraceElement::toString).collect(Collectors.joining("|")); log.error("Allocating buffer of size {} for source {}", requestedBufferSize, source); diff --git a/pom.xml b/pom.xml index 5093c19435..66b153d63a 100755 --- a/pom.xml +++ b/pom.xml @@ -113,7 +113,7 @@ - 3.7.2 + 3.9.1 8.10.1 3.5.3 2.2 From 6a5fd0d45c171a06048c39bb5e2f58a038304627 Mon Sep 17 00:00:00 2001 From: Sergey Matvienko Date: Fri, 13 Jun 2025 15:32:44 +0200 Subject: [PATCH 3/8] CVE-2024-12798 logback 1.5.5 -> 1.5.18 --- pom.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pom.xml b/pom.xml index 66b153d63a..88efe6723f 100755 --- a/pom.xml +++ b/pom.xml @@ -52,9 +52,9 @@ 6.3.8 5.1.5 0.12.5 - 2.0.13 - 2.23.1 - 1.5.5 + 2.0.17 + 2.24.3 + 1.5.18 0.10 4.17.0 4.2.25 From 1d1a72d54dd0678fca776f555fa0ed6fda0a8aae Mon Sep 17 00:00:00 2001 From: Sergey Matvienko Date: Fri, 13 Jun 2025 15:35:06 +0200 Subject: [PATCH 4/8] CVE-2024-51504 org.apache.zookeeper:zookeeper@3.9.3 --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 88efe6723f..011b1c967b 100755 --- a/pom.xml +++ b/pom.xml @@ -83,7 +83,7 @@ 2.3.32 2.0.1 5.6.0 - 3.9.2 + 3.9.3 3.25.5 1.63.0 1.2.6 From b69460ab01f86edbe81c5aef5f8220dcc1678942 Mon Sep 17 00:00:00 2001 From: Sergey Matvienko Date: Fri, 13 Jun 2025 15:42:13 +0200 Subject: [PATCH 5/8] CVE-2025-4949 org.eclipse.jgit:org.eclipse.jgit@6.10.1.202505221210-r --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 011b1c967b..fd21733bd3 100755 --- a/pom.xml +++ b/pom.xml @@ -158,7 +158,7 @@ 2.12.0 3.0.2 - 6.9.0.202403050737-r + 6.10.1.202505221210-r 0.4.8 1.0.0 From 14b3df350260142f856f0e62a1974e92dff981e7 Mon Sep 17 00:00:00 2001 From: Sergey Matvienko Date: Fri, 13 Jun 2025 15:44:51 +0200 Subject: [PATCH 6/8] CVE-2025-46701 org.apache.tomcat.embed:tomcat-embed-core@10.1.42 --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index fd21733bd3..94cdff0e9f 100755 --- a/pom.xml +++ b/pom.xml @@ -42,7 +42,7 @@ 4.0.2 2.4.0-b180830.0359 4.0.5 - 10.1.40 + 10.1.42 2.5.2 3.2.12 3.2.12 From 56da48e2075743f212ec4613f07e90fa07eee6ef Mon Sep 17 00:00:00 2001 From: Sergey Matvienko Date: Fri, 13 Jun 2025 15:49:47 +0200 Subject: [PATCH 7/8] CVE-2025-41234 org.springframework:spring-web@6.1.15 -> org.springframework:spring-web@6.1.21 --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 94cdff0e9f..f38ed581a1 100755 --- a/pom.xml +++ b/pom.xml @@ -47,7 +47,7 @@ 3.2.12 3.2.12 3.2.12 - 6.1.15 + 6.1.21 6.2.11 6.3.8 5.1.5 @@ -1173,7 +1173,7 @@ org.springframework.boot - spring-boot-starter + spring-boot-starter ${spring-boot.version} From a39547ddeedef581aad8cd57870c41b5dd224ee3 Mon Sep 17 00:00:00 2001 From: Sergey Matvienko Date: Fri, 13 Jun 2025 16:08:11 +0200 Subject: [PATCH 8/8] CVE-2025-22234 org.springframework.security:spring-security-crypto@6.3.9 --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index f38ed581a1..3e0a67ab0d 100755 --- a/pom.xml +++ b/pom.xml @@ -49,7 +49,7 @@ 3.2.12 6.1.21 6.2.11 - 6.3.8 + 6.3.9 5.1.5 0.12.5 2.0.17