Critical and High Vulnerabilities reported for quarkus-logging-json in National Vulnerability Database

[quarkiverse]

Critical and High Vulnerabilities reported for quarkus-logging-json in National Vulnerability Database

[agatarychter]

I am using Quarkus version 2.7.0.Final (I've checked also for 2.5.4.Final and 2.5.0.Final) and quarkiverse/quarkus-logging-json version 1.1.1.

[SlyngDK]

Which issues for dependencies used in this project, default is quarkus bom will override these.

[gsmet]

The report has nothing to do with the Logging JSON Quarkiverse extension.

The report is about Quarkus 1.1.1.Final itself AFAICS. A good indicator something is wrong with your report is that it references quarkus/quarkus/1.1.1 and that it complains about the PostgreSQL JDBC driver, which this extension does not use.

I would advise you to check the reports more carefully and also to check what's wrong with your reporting because, given the other issue you created in the Quarkus project, your reporting is incorrect.