How to fix the security problem of the EPR and logstash 8.15.0

Elastic Stack Kibana
1

Elastic Package Registry and logstash has been scanned for the following vulnerabilities，is there anyway to fix them ?

version 8.15.0

EPR:

ebf660a8ce08cab4ce019fb109cff88
ebf660a8ce08cab4ce019fb109cff881693×183 16.1 KB

CVE-2023-42365
CVE-2023-42364
CVE-2023-42366
CVE-2023-42363
CVE-2023-6992
CVE-2024-7264
CVE-2024-6197

busybox 1.36.1-r7 no recommend
zlib 1.3.1-r0 recommend 1.3.1-r1
curl 8.7.1-r0 recommend 8.9.1-r1

Logstash

21ccded9aa0c2e4a0752a309ea15bf0
21ccded9aa0c2e4a0752a309ea15bf01056×151 8.45 KB

rexml 3.3.2 recommend 3.3.3
janino 3.1.0 recommend 3.1.10

CVE-2024-41123
CVE-2024-41946
CVE-2023-33546
how to upgrade or remove them?

2

You can't upgrade them, only Elastic can.

You need to send an e-mail to security@elastic.co with those CVEs so Elastic can analyse them and decide if they impact Logstash or not.

3

ok，thks @leandrojmp

4

hi,about EPR vulnerability,Can you provide specific repair steps? i don't know how to upgrade them directly.
I am using the air-gapped docker image of EPR. thks