[GH-ISSUE #2336] Vulnerabilities and Driver Updates in Cloudbeaver #751

New issue

Closed

opened 2026-03-07 20:54:09 +03:00 by kerem · 0 comments

kerem commented

2026-03-07 20:54:09 +03:00

Owner

Originally created by @YuraKril on GitHub (Jan 26, 2024).
Original GitHub issue: https://github.com/dbeaver/cloudbeaver/issues/2336

I have identified several vulnerabilities in Cloudbeaver version 23.3.3. I noticed that you plan to update the Ubuntu base image to version 23.10 in the next release, which is a positive step. However, I would like to suggest an additional improvement to enhance security and manage vulnerabilities more effectively.

Recommendation:
Consider updating all drivers to their current latest versions. Instead of embedding all drivers as *.jar files within the Docker image, I propose implementing a functionality that allows users to download and enable drivers after the project build.

This approach offers several benefits:

Reduced Image Size: By not including all drivers in the initial Docker image, the size of the image can be minimized.

Enhanced Security: Allowing users to enable and download specific drivers after the build ensures that only necessary components are included, reducing potential vulnerabilities.

Flexibility: Users can select and install only the drivers they need, providing greater customization and reducing unnecessary dependencies.

Implementation:
Introduce a feature in Cloudbeaver that enables users to manage and download drivers post-build. This could involve a dedicated interface or command-line options for driver management.

I believe this improvement will contribute to a more secure and efficient system. Thank you for considering this recommendation,

Originally created by @YuraKril on GitHub (Jan 26, 2024). Original GitHub issue: https://github.com/dbeaver/cloudbeaver/issues/2336 I have identified several vulnerabilities in Cloudbeaver version 23.3.3. I noticed that you plan to update the Ubuntu base image to version 23.10 in the next release, which is a positive step. However, I would like to suggest an additional improvement to enhance security and manage vulnerabilities more effectively. Recommendation: Consider updating all drivers to their current latest versions. Instead of embedding all drivers as *.jar files within the Docker image, I propose implementing a functionality that allows users to download and enable drivers after the project build. This approach offers several benefits: Reduced Image Size: By not including all drivers in the initial Docker image, the size of the image can be minimized. Enhanced Security: Allowing users to enable and download specific drivers after the build ensures that only necessary components are included, reducing potential vulnerabilities. Flexibility: Users can select and install only the drivers they need, providing greater customization and reducing unnecessary dependencies. Implementation: Introduce a feature in Cloudbeaver that enables users to manage and download drivers post-build. This could involve a dedicated interface or command-line options for driver management. I believe this improvement will contribute to a more secure and efficient system. Thank you for considering this recommendation,