This message was deleted.

I’m sorry, but the knowledge sources do not contain any information specific to

airbyte/airbyte-base-java-image:3.3

, its package list, or the particular CVEs you listed (for

openssl

,

glib2

,

libpng

,

gnupg2

,

libtasn1

). I can’t confirm whether those exact CVEs are known/tracked for that image, nor point to a specific fixed tag for

airbyte-base-java-image

itself. What is documented: • Airbyte regularly updates base images (both platform and connector images) specifically to address OS‑level security vulnerabilities. This is called out repeatedly in release notes for the core platform (e.g., 1.5.x, 1.7.x, 1.8.x, 2.0) and in connector PRs. [Airbyte 1.5 notes; Airbyte 2.0 notes] • Multiple patch releases are explicitly labeled as “security patch release” where “base images have been updated to address security vulnerabilities.” [Airbyte 1.7 notes; Airbyte 1.8 notes] • For connectors, there are concrete examples of bumping Java base images to newer versions specifically “to pick up CVE patches in transitive dependencies” and “security-related patches.” [CDK/base bump; source-postgres base bump] • There is an open security‑vulnerability issue for 1.7.2 where the requested action from the user is “update base images to fix vulnerable dependencies,” and the general pattern in the release notes shows that such issues are handled via base‑image bumps in subsequent patch releases. [Security report 1.7.2; Airbyte 1.7 notes] Given these sources, the only defensible guidance I can provide is: 1. Tracking / awareness of CVEs for base images The docs and PRs show that Airbyte does track and remediate CVEs in base images on an ongoing basis (both for the platform and for connector base images), but they do not enumerate specific CVEs or package versions for

airbyte-base-java-image:3.3

. [CDK/base bump; Airbyte 2.0 notes] So I cannot confirm from the available information whether the exact CVEs you list are: ◦ already mitigated in a newer

airbyte-base-java-image

tag, or ◦ still open and being tracked for

3.3

. 2. Fixed or planned base image version to upgrade to The knowledge sources show a pattern of: ◦ Regular base‑image bumps in patch releases (e.g., 1.5.2–1.5.7, 1.7.2, 1.7.3, 1.7.5–1.7.7, 1.8.4–1.8.5, 2.0) to address security vulnerabilities. [Airbyte 1.5 notes; Airbyte 1.7 notes; Airbyte 1.8 notes; Airbyte 2.0 notes] ◦ Connector‑specific bumps to newer Java base images (e.g.,

java-connector-base:2.0.3

,

2.0.4

) explicitly to pick up CVE patches. [source-postgres base bump; CDK/base bump] However, there is no explicit mapping in the provided sources from: ◦

airbyte-base-java-image:3.3

→ a newer, recommended tag, or ◦ any statement like “use

airbyte-base-java-image:X.Y

to fix CVE‑2025‑9230 / CVE‑2025‑13601 / …”. So I cannot name a specific fixed base image version for you based on these documents. ------------------------- Practical next steps (based on what is documented): • If possible, align your deployment with a recent Airbyte platform release that is explicitly labeled as a security patch (for example, 1.7.7, 1.8.5, or 2.0+), since those releases are documented as having updated base images to address security vulnerabilities. [Airbyte 1.7 notes; Airbyte 1.8 notes; Airbyte 2.0 notes] • For a definitive answer on

airbyte-base-java-image:3.3

and the specific CVEs you listed, you’ll need to: ◦ Open or comment on a GitHub issue (similar to the existing 1.7.2 vulnerability report) with your scan results and the exact image digest, or ◦ Contact Airbyte support if you’re an enterprise customer. Those channels can confirm whether these CVEs are already remediated in a newer

airbyte-base-java-image

tag and which exact tag your

container-orchestrator

,

workload-init-container

, and

connector-sidecar

images should move to. 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups or DM the app for 1-to-1 help.