[go: nahoru, domu]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2022-3171 Vulnerability #2961

Closed
gargshubham49 opened this issue Jun 3, 2024 · 4 comments
Closed

CVE-2022-3171 Vulnerability #2961

gargshubham49 opened this issue Jun 3, 2024 · 4 comments
Labels
datastore

Comments

@gargshubham49
Copy link

We are using GCP dependencies with version 5.4.1
We got the HIGH severity vulnerability(CVE-2022-3171) in the library google-http-client-protobuf-1.44.1.jar which is included by following module:
com.google.cloud:spring-cloud-gcp-data-datastore:5.4.1
@meltsufin meltsufin mentioned this issue Jun 3, 2024
Open
1 task
@meltsufin
Copy link
Member

Can you please share your mvn dependency:tree output?
google-http-client-protobuf:1.44.1 depends on protobuf-java:1.21.12, which is not listed as vulnerable.
In any case we override protobuf-java version to 3.25.3.

@burkedavison
Copy link
Member

Link showing what meltsufin@ mentions above:
https://github.com/googleapis/google-http-java-client/blob/v1.44.1/pom.xml#L601

@gargshubham49
Copy link
Author
gargshubham49 commented Jun 4, 2024 •
edited
Loading

Dependency graph shows protobuf-java version as 3.25.3
image

But the dependency check is showing the vulnerability for protobuf-java
image

@meltsufin
Copy link
Member

What tool is that? I would suggest following up with them.
Closing. Please re-open if you can confirm that it's not a problem with the tool or interpretation of its output.

@meltsufin meltsufin closed this as not planned Won't fix, can't repro, duplicate, stale Jun 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
datastore
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@meltsufin @burkedavison @gargshubham49