I am using KUBE_PING (jgroups-kubernetes-1.0.13.Final.jar) as the discovery protocol for my application running under OpenShift-4.5 (Kubernetes-version 1.18.3). When I ran a vulnerability report against jgroups-kubernetes-1.0.13.Final.jar the NVD database reported CRITICAL vulnerabilities against the Kubernetes Server (Eg: CVE-2015-7528, CVE-2020-8557)
My question here is that the Kubernetes API Server vulnerabilities are to managed separately by the Cloud Container Platform (Like OpenShift, Amazon EKS, etc) and should be responsible for the same. These vulnerabilities are not to be considered directly against JGroups discovery client for Kubernetes. The jgroups-kubernetes-1.0.13.Final.jar is only vulnerable when connecting against the reported vulnerable Kubernetes server versions. Is this the right assumption?
Main Point - Whether the version no. in jgroups-kubernetes-ver.jar has any dependency to the actual kubernetes server version.
Know someone who can answer?