You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@beam.apache.org by "pineapple-pokopo (via GitHub)" <gi...@apache.org> on 2025/07/15 14:01:56 UTC
[I] [Task]: Google Cloud Platform Expansion Service still contains CVE-2024-47561 [beam]
pineapple-pokopo opened a new issue, #35594:
URL: https://github.com/apache/beam/issues/35594
### What needs to happen?
The latest version (2.66.0) of the [Java IO Google Cloud Platform Expansion Service](https://mvnrepository.com/artifact/org.apache.beam/beam-sdks-java-io-google-cloud-platform-expansion-service) still contains an outdated version of Avro (1.11.3). It should be upgraded to 1.11.4 to fix https://github.com/advisories/GHSA-r7pg-v2c8-mfg3.
There is a related issue #34968 with PRs that tried to resolve this but these apparently failed.
### Issue Priority
Priority: 2 (default / most normal work should be filed as P2)
### Issue Components
- [ ] Component: Python SDK
- [x] Component: Java SDK
- [ ] Component: Go SDK
- [ ] Component: Typescript SDK
- [ ] Component: IO connector
- [ ] Component: Beam YAML
- [ ] Component: Beam examples
- [ ] Component: Beam playground
- [ ] Component: Beam katas
- [ ] Component: Website
- [ ] Component: Infrastructure
- [ ] Component: Spark Runner
- [ ] Component: Flink Runner
- [ ] Component: Samza Runner
- [ ] Component: Twister2 Runner
- [ ] Component: Hazelcast Jet Runner
- [ ] Component: Google Cloud Dataflow Runner
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Google Cloud Platform Expansion Service still contains CVE-2024-47561 [beam]
Posted by "liferoad (via GitHub)" <gi...@apache.org>.
liferoad commented on issue #35594:
URL: https://github.com/apache/beam/issues/35594#issuecomment-3084539246
```
./gradlew :sdks:java:extensions:avro:dependencies --configuration compileClasspath
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Google Cloud Platform Expansion Service still contains CVE-2024-47561 [beam]
Posted by "liferoad (via GitHub)" <gi...@apache.org>.
liferoad commented on issue #35594:
URL: https://github.com/apache/beam/issues/35594#issuecomment-3084547074
https://github.com/apache/beam/issues/34993 is also related here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Google Cloud Platform Expansion Service still contains CVE-2024-47561 [beam]
Posted by "liferoad (via GitHub)" <gi...@apache.org>.
liferoad commented on issue #35594:
URL: https://github.com/apache/beam/issues/35594#issuecomment-3085420115
Thanks, @Abacn, for the fix.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Google Cloud Platform Expansion Service still contains CVE-2024-47561 [beam]
Posted by "liferoad (via GitHub)" <gi...@apache.org>.
liferoad closed issue #35594: [Task]: Google Cloud Platform Expansion Service still contains CVE-2024-47561
URL: https://github.com/apache/beam/issues/35594
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Google Cloud Platform Expansion Service still contains CVE-2024-47561 [beam]
Posted by "liferoad (via GitHub)" <gi...@apache.org>.
liferoad commented on issue #35594:
URL: https://github.com/apache/beam/issues/35594#issuecomment-3084523679
https://develocity.apache.org/s/hpnprjk23uzpm/dependencies?focusedDependencyView=versions&toggled=W1s5XSxbMTFdLFsxMSwwXSxbMTEsMl0sWzExLDIsWzI4NzJdXV0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Task]: Google Cloud Platform Expansion Service still contains CVE-2024-47561 [beam]
Posted by "liferoad (via GitHub)" <gi...@apache.org>.
liferoad commented on issue #35594:
URL: https://github.com/apache/beam/issues/35594#issuecomment-3084544362
This https://github.com/apache/beam/blob/db0c17fd80ee12d95f5b75928f81b8b9d86c7a18/buildSrc/src/main/groovy/org/apache/beam/gradle/BeamModulePlugin.groovy#L679 downgrades avro to 1.11.3
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org