Fix CVSS 9.8 CVE in Camunda 7 BPM platform docker image

[jim60105]

Close issue: https://forum.camunda.io/t/cvss-9-8-cve-in-camunda-7-bpm-platform-docker-image/59700

---

Hi camunda team,

Our team scanned the camunda/camunda-bpm-platform:7.22.0 docker image and found that it contains a package with critical and high risk-level vulnerabilities.

/camunda/javaagent/jmx_prometheus_javaagent.jar
pkg:maven/org.yaml/snakeyaml@1.16
CVE-2022-1471
CVE-2017-18640
CVE-2022-25857

They are originates from an outdated jmx_exporter, which was added in download.sh script.

Fortunately, the version has been extracted as an ARG in the Dockerfile, making it easy to upgrade to a new version.

---

This PR will fix the above issue.
I would be very grateful if this could be merged.
Thank you.

[CLAassistant]

All committers have signed the CLA.

[HeleneW-dot]

Hi @jim60105 ,
Thank you for raising this issue, I am going to have a closer look at your report and post another update here once we have qualified the issue.
For the future, please raise security concerns via our trust center instead of the public repo or forum.

Thanks!
Helene

[HeleneW-dot]

Hi @jim60105, we've had a look at this dependency and found the following:

• The Prometheus JMX Exporter is disabled by default
• This vulnerability only exists when using the WildFly or Tomcat Docker image with a configuration from untrusted sources
• Applying configurations from untrusted sources is an anti-pattern leading to more severe problems

We will still look into bumping this dependency, however we first need to conduct some internal checks such as licensing. Once these checks have passed, I will post another update here on whether we can merge this PR.

Thank you,
Helene

[HeleneW-dot]

Running CI workflows in this PR with a duplicate branch to avoid unauthorised exception.

[HeleneW-dot]

Hi @jim60105 ,
just to keep you informed, this change required a few more follow up adjustments to make our current CI compatible with this version bump. I have created this PR for that purpose which will be reviewed soon. I can add you as a co-author on it before merging.
I will close this PR for now since it is now a duplicate as your changes have already been picked over to the other PR.

Thank you again for your contribution!
Helene

[jim60105]

Understood, thank you for your reply.

[HeleneW-dot]

Hi @jim60105 ,
Just to let you know, the changes have now been merged.
Thank you,
Helene