RHSA-2025:2416: Important: Streams for Apache Kafka 2.9.0 release and security update

Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed<br>backbone that allows microservices and other applications to share data with<br>extremely high throughput and extremely low latency.<br>This release of Red Hat Streams for Apache Kafka 2.9.0 serves as a replacement for Red Hat Streams for Apache Kafka 2.8.0, and includes security and bug fixes, and enhancements.<br>Security Fix(es):<br><li> Cruise Control:cio.netty:netty-common:4.1.115.Final-redhat [amq-st-2] "(CVE-2023-52428)"</li> <li> Cruise Control:com.nimbusds:nimbus-jose-jwt:9.37.2.redhat [amq-st-2] "(CVE-2024-47535)"</li> <li> Cruise Control:org.apache.kafka:kafka-clients:3.5.2.redhat+ [amq-st-2] "(CVE-2024-31141)"</li> <li> Cruise Control:io:commons-io:2.15.1.redhat+ [amq-st-2] "(CVE-2024-47554)"</li> <li> Cruise Control:org.eclipse.jetty:jetty-server:9.4.56.v20240826-redhat+ [amq-st-2] "(CVE-2024-8184)"</li> <li> Cruise Control:org.eclipse.jetty/jetty-server: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks [amq-st-2] "(CVE-2024-8184)"</li> <li> Kafka Exporter:golang-github-danielqsj-kafkaexporter: Golang FIPS zeroed buffer [amq-st-2] "(CVE-2024-9355)"</li> <li> Kafka Exporter:golang-github-danielqsj-kafkaexporter: net/<a href="http:" target="blank">http:</a> Denial of service due to improper 100-continue handling in net/http [amq-st-2] "(CVE-2024-24791)"</li>