Is Clarity Vulnerable to CVE-2023-3782

Products

• Clarity PPM On Premise
• Clarity FedRAMP
• Clarity PPM SaaS

Issue/Introduction

Is CVE-2023-3782 impacting Clarity?

Environment

Clarity all supported versions 

Resolution

 Clarity as application is not vulnerable to CVE-2023-3782 and below are the rationale supporting the same 

• The CVE-2023-3782  specifically targets the okhttp-brotli package (specifically the BrotliInterceptor class)
• Clarity utilize the core okhttp and logging-interceptor libraries (v4.11.0), however we do not include okhttp-brotli.
• Clarity uses Ok Http for Kubernetes API communication and standard HTTP operations however Clarity does not use Brotli compression/decompression
• Official advisories indicate no patch is currently available even in version 5.x; however, since the vulnerable class is not included in Clarity class path, there is no attack surface