Skip to content

Update protobuf to 3.25.5 to resolve CVE-2024-7254#7664

Merged
matthew1001 merged 1 commit intobesu-eth:mainfrom
matthew1001:protobuf-cve
Sep 23, 2024
Merged

Update protobuf to 3.25.5 to resolve CVE-2024-7254#7664
matthew1001 merged 1 commit intobesu-eth:mainfrom
matthew1001:protobuf-cve

Conversation

@matthew1001
Copy link
Copy Markdown
Contributor

@matthew1001 matthew1001 commented Sep 23, 2024

PR description

Our vulnerability scan has shown up a HIGH CVE in com.google.protobuf:

┌──────────────────────────────────────────────────────────────┬───────────────┬──────────┬────────┬───────────────────┬────────────────────────┬───────────────────────────────────────────────────────────┐
│                           Library                            │ Vulnerability │ Severity │ Status │ Installed Version │     Fixed Version      │                           Title                           │
├──────────────────────────────────────────────────────────────┼───────────────┼──────────┼────────┼───────────────────┼────────────────────────┼───────────────────────────────────────────────────────────┤
│ com.google.protobuf:protobuf-java (protobuf-java-3.22.0.jar) │ CVE-2024-7254 │ HIGH     │ fixed  │ 3.22.0            │ 3.25.5, 4.27.5, 4.28.2 │ protobuf: StackOverflow vulnerability in Protocol Buffers │
│                                                              │               │          │        │                   │                        │ https://avd.aquasec.com/nvd/cve-2024-7254                 │
└──────────────────────────────────────────────────────────────┴───────────────┴──────────┴────────┴───────────────────┴────────────────────────┴───────────────────────────────────────────────────────────┘

This PR updates the dependency to version 3.25.5

@matthew1001
Update protobuf to 32.25.5 to resolve CVE-2024-7254
5b0cec9 
Signed-off-by: Matthew Whitehead <matthew.whitehead@kaleido.io>
This was referenced Sep 23, 2024
Merged
Merged
@matthew1001 matthew1001 changed the title Update protobuf to 32.25.5 to resolve CVE-2024-7254 Update protobuf to 3.25.5 to resolve CVE-2024-7254 Sep 23, 2024
@matthew1001 matthew1001 merged commit 874cba0 into besu-eth:main Sep 23, 2024
Wolmin pushed a commit to lukso-network/network-besu that referenced this pull request Sep 27, 2024
@matthew1001 @Wolmin
Update protobuf to 32.25.5 to resolve CVE-2024-7254 (besu-eth#7664)
78f7c62 
Signed-off-by: Matthew Whitehead <matthew.whitehead@kaleido.io>
Signed-off-by: Wolmin <lamonos123@gmail.com>
This was referenced Oct 5, 2024
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@macfarla macfarla macfarla approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@matthew1001 @macfarla