You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by GitBox <gi...@apache.org> on 2022/10/17 06:14:36 UTC
[GitHub] [skywalking-java] alanlvle opened a new pull request, #350: fix CVE-2022-3171
alanlvle opened a new pull request, #350:
URL: https://github.com/apache/skywalking-java/pull/350
<!--
β οΈ Please make sure to read this template first, pull requests that don't accord with this template
maybe closed without notice.
Texts surrounded by `<` and `>` are meant to be replaced by you, e.g. <framework name>, <issue number>.
Put an `x` in the `[ ]` to mark the item as CHECKED. `[x]`
-->
<!-- ==== π Remove this line WHEN AND ONLY WHEN you're fixing a bug, follow the checklist π ====
### Fix <bug description or the bug issue number or bug issue link>
- [ ] Add a unit test to verify that the fix works.
- [ ] Explain briefly why the bug exists and how to fix it.
==== π Remove this line WHEN AND ONLY WHEN you're fixing a bug, follow the checklist π ==== -->
<!-- ==== π Remove this line WHEN AND ONLY WHEN you're adding a new plugin, follow the checklist π ====
### Add an agent plugin to support <framework name>
- [ ] Add a test case for the new plugin, refer to [the doc](https://github.com/apache/skywalking-java/blob/main/docs/en/setup/service-agent/java-agent/Plugin-test.md)
- [ ] Add a component id in [the component-libraries.yml](https://github.com/apache/skywalking/blob/master/oap-server/server-starter/src/main/resources/component-libraries.yml)
- [ ] Add a logo in [the UI repo](https://github.com/apache/skywalking-rocketbot-ui/tree/master/src/views/components/topology/assets)
==== π Remove this line WHEN AND ONLY WHEN you're adding a new plugin, follow the checklist π ==== -->
<!-- ==== π Remove this line WHEN AND ONLY WHEN you're improving the performance, follow the checklist π ====
### Improve the performance of <class or module or ...>
- [ ] Add a benchmark for the improvement, refer to [the existing ones](https://github.com/apache/skywalking-java/blob/main/apm-commons/apm-datacarrier/src/test/java/org/apache/skywalking/apm/commons/datacarrier/LinkedArrayBenchmark.java)
- [ ] The benchmark result.
```text
<Paste the benchmark results here>
```
- [ ] Links/URLs to the theory proof or discussion articles/blogs. <links/URLs here>
==== π Remove this line WHEN AND ONLY WHEN you're improving the performance, follow the checklist π ==== -->
<!-- ==== π Remove this line WHEN AND ONLY WHEN you're adding a new feature, follow the checklist π ====
### <Feature description>
- [ ] If this is non-trivial feature, paste the links/URLs to the design doc.
- [ ] Update the documentation to include this new feature.
- [ ] Tests(including UT, IT, E2E) are added to verify the new feature.
- [ ] If it's UI related, attach the screenshots below.
==== π Remove this line WHEN AND ONLY WHEN you're adding a new feature, follow the checklist π ==== -->
- [ ] If this pull request closes/resolves/fixes an existing issue, replace the issue number. Closes #<issue number>.
- [ ] Update the [`CHANGES` log](https://github.com/apache/skywalking-java/blob/main/CHANGES.md).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-java] lujiajing1126 commented on a diff in pull request #350: Bump up grpc-protobuf to 1.50.0 to fix CVE-2022-3171
Posted by GitBox <gi...@apache.org>.
lujiajing1126 commented on code in PR #350:
URL: https://github.com/apache/skywalking-java/pull/350#discussion_r996688671
##########
pom.xml:
##########
@@ -87,7 +87,7 @@
<!-- core lib dependency -->
<bytebuddy.version>1.12.13</bytebuddy.version>
- <grpc.version>1.44.0</grpc.version>
+ <grpc.version>1.50.0</grpc.version>
Review Comment:
`protobuf` should also be updated to be aligned with `grpc`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-java] wu-sheng commented on a diff in pull request #350: Bump up grpc-protobuf to 1.50.0 to fix CVE-2022-3171
Posted by GitBox <gi...@apache.org>.
wu-sheng commented on code in PR #350:
URL: https://github.com/apache/skywalking-java/pull/350#discussion_r996963544
##########
CHANGES.md:
##########
@@ -14,6 +14,7 @@ Release Notes.
* Fix `Apache ShenYu` plugin traceId empty string value.
* Add plugin to support [brpc-java-3.x](https://github.com/baidu/starlight/tree/brpc-java-v3)
* Update `compose-start-script.template` to make compatible with new version docker compose
+* Bump up grpc-protobuf to 1.50.0 to fix CVE-2022-3171
Review Comment:
```suggestion
* Bump up grpc to 1.50.0 to fix CVE-2022-3171
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-java] alanlvle commented on pull request #350: Bump up grpc-protobuf to 1.50.0 to fix CVE-2022-3171
Posted by GitBox <gi...@apache.org>.
alanlvle commented on PR #350:
URL: https://github.com/apache/skywalking-java/pull/350#issuecomment-1280378436
Which files are updated? need help
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-java] alanlvle commented on a diff in pull request #350: Bump up grpc-protobuf to 1.50.0 to fix CVE-2022-3171
Posted by GitBox <gi...@apache.org>.
alanlvle commented on code in PR #350:
URL: https://github.com/apache/skywalking-java/pull/350#discussion_r996774201
##########
pom.xml:
##########
@@ -87,7 +87,7 @@
<!-- core lib dependency -->
<bytebuddy.version>1.12.13</bytebuddy.version>
- <grpc.version>1.44.0</grpc.version>
+ <grpc.version>1.50.0</grpc.version>
Review Comment:
yes,I find gRPC vesion config use same configurationγ All update to 1.50.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-java] wu-sheng commented on pull request #350: Bump up grpc-protobuf to 1.50.0 to fix CVE-2022-3171
Posted by GitBox <gi...@apache.org>.
wu-sheng commented on PR #350:
URL: https://github.com/apache/skywalking-java/pull/350#issuecomment-1280343720
You should update change log and license to adopt this version change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-java] wu-sheng commented on pull request #350: Bump up grpc-protobuf to 1.50.0 to fix CVE-2022-3171
Posted by GitBox <gi...@apache.org>.
wu-sheng commented on PR #350:
URL: https://github.com/apache/skywalking-java/pull/350#issuecomment-1280395554
The version of the binary license, https://github.com/apache/skywalking-java/blob/main/dist-material/LICENSE#L220
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-java] alanlvle commented on a diff in pull request #350: Bump up grpc-protobuf to 1.50.0 to fix CVE-2022-3171
Posted by GitBox <gi...@apache.org>.
alanlvle commented on code in PR #350:
URL: https://github.com/apache/skywalking-java/pull/350#discussion_r996943582
##########
pom.xml:
##########
@@ -87,7 +87,7 @@
<!-- core lib dependency -->
<bytebuddy.version>1.12.13</bytebuddy.version>
- <grpc.version>1.44.0</grpc.version>
+ <grpc.version>1.50.0</grpc.version>
Review Comment:
update it. check the netty version is ok.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-java] wu-sheng commented on a diff in pull request #350: Bump up grpc-protobuf to 1.50.0 to fix CVE-2022-3171
Posted by GitBox <gi...@apache.org>.
wu-sheng commented on code in PR #350:
URL: https://github.com/apache/skywalking-java/pull/350#discussion_r996731785
##########
pom.xml:
##########
@@ -87,7 +87,7 @@
<!-- core lib dependency -->
<bytebuddy.version>1.12.13</bytebuddy.version>
- <grpc.version>1.44.0</grpc.version>
+ <grpc.version>1.50.0</grpc.version>
Review Comment:
If it does, you should consider bumping up gRPC as well.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-java] alanlvle commented on a diff in pull request #350: Bump up grpc-protobuf to 1.50.0 to fix CVE-2022-3171
Posted by GitBox <gi...@apache.org>.
alanlvle commented on code in PR #350:
URL: https://github.com/apache/skywalking-java/pull/350#discussion_r996712794
##########
pom.xml:
##########
@@ -87,7 +87,7 @@
<!-- core lib dependency -->
<bytebuddy.version>1.12.13</bytebuddy.version>
- <grpc.version>1.44.0</grpc.version>
+ <grpc.version>1.50.0</grpc.version>
Review Comment:
grpc have fix protobuf
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-java] wu-sheng commented on a diff in pull request #350: Bump up grpc-protobuf to 1.50.0 to fix CVE-2022-3171
Posted by GitBox <gi...@apache.org>.
wu-sheng commented on code in PR #350:
URL: https://github.com/apache/skywalking-java/pull/350#discussion_r996819964
##########
pom.xml:
##########
@@ -87,7 +87,7 @@
<!-- core lib dependency -->
<bytebuddy.version>1.12.13</bytebuddy.version>
- <grpc.version>1.44.0</grpc.version>
+ <grpc.version>1.50.0</grpc.version>
Review Comment:
`com.google.protobuf.protoc.version` and `protoc-gen-grpc-java.plugin.version` should be updated as well.
And please check the netty version grpc-java bundling, which our 4.1.79.Final is suitable or lower.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-java] wu-sheng merged pull request #350: Bump up grpc to 1.50.0 to fix CVE-2022-3171
Posted by GitBox <gi...@apache.org>.
wu-sheng merged PR #350:
URL: https://github.com/apache/skywalking-java/pull/350
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org