Fix code scanning alert - libexpat: Integer Overflow or Wraparound

[SanjayVas]

CVE-2024-45491

• build: Update base Java images common-jvm#279
• build: Update common-jvm dep for base Java images #1829

Tracking issue for:

• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1408
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1444
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1414
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1432
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1426
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1441
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1429
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1423
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1435
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1411
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1438
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1417
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1420
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1387
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1372
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1399
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1390
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1384
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1402
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1375
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1363
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1396
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1405
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1378
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1366
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1357
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1393
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1360
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1369
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1381
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1447
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1351
• https://github.com/world-federation-of-advertisers/cross-media-measurement/security/code-scanning/1354

[SanjayVas]

Not yet fixed in upstream Debian Bookworm. See https://security-tracker.debian.org/tracker/CVE-2024-45491

[SanjayVas]

Looks like bookworm (security) has the fixed version now, which means it should be picked up by upstream distroless soon.

[SanjayVas]

Appears to be fixed in latest gcr.io/distroless/java17-debian12:nonroot (sha256:2db4acff2603088acaf67dac414462c9fcc3e2cc3ff9a642d5af9c7cff2b5fe9)