Windows installer packages unused Kafka client libraries that include a vulnerable libcurl #6018

Who's affected

Anyone who installs ServiceControl error or audit instances that use RavenDB persistence with the Windows installer (ServiceControl Management).

Symptoms

The RavenDB server files installed with an instance include libcurl.dll 8.19.0, along with librdkafka.dll and librdkafkacpp.dll. That version of curl has published vulnerabilities, so vulnerability scanners may flag the installation directory.

These libraries are only used by RavenDB's Kafka ETL and sink features. ServiceControl doesn't configure those features, and the RavenDB license bundled with ServiceControl has them disabled, so ServiceControl never loads these libraries.

Resolution

The Windows installer no longer packages libcurl.dll, librdkafka.dll, or librdkafkacpp.dll with the RavenDB server. Upgrading an instance replaces its installation directory, so the files are removed as part of a normal upgrade. This change applies only to the Windows installer.

Backported to

• 6.21.3: Exclude unused Kafka libraries and update .NET to 10.0.13 #6019