You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by "lhotari (via GitHub)" <gi...@apache.org> on 2023/04/04 05:34:02 UTC
[GitHub] [pulsar] lhotari opened a new pull request, #20005: [fix][build] Suppress Guava CVE-2020-8908 in OWASP dependency check
lhotari opened a new pull request, #20005:
URL: https://github.com/apache/pulsar/pull/20005
### Motivation
- Fix OWASP dependency check for master branch
- The vulnerable method is deprecated in Guava, but isn't removed. It's necessary to suppress this CVE. See https://github.com/google/guava/issues/4011
### Modifications
- suppress CVE-2020-8908
### Documentation
<!-- DO NOT REMOVE THIS SECTION. CHECK THE PROPER BOX ONLY. -->
- [ ] `doc` <!-- Your PR contains doc changes. -->
- [ ] `doc-required` <!-- Your PR changes impact docs and you will update later -->
- [x] `doc-not-needed` <!-- Your PR changes do not impact docs -->
- [ ] `doc-complete` <!-- Docs have been already added -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] lhotari merged pull request #20005: [fix][build] Suppress Guava CVE-2020-8908 in OWASP dependency check
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari merged PR #20005:
URL: https://github.com/apache/pulsar/pull/20005
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] FyiurAmron commented on pull request #20005: [fix][build] Suppress Guava CVE-2020-8908 in OWASP dependency check
Posted by "FyiurAmron (via GitHub)" <gi...@apache.org>.
FyiurAmron commented on PR #20005:
URL: https://github.com/apache/pulsar/pull/20005#issuecomment-1516371653
Frankly, why have you decided to suppress it? If it's your dependency, you'll be transitively including it into any user consuming your library via classpath. There, it creates a (however unlikely) attack surface, since as long as it's loaded from classpath during runtime, a malicious actor might use an innocent-looking call to this deprecated method to e.g. create a backdoor that's mostly indistinguishable from normal code.
I agree that this is completely unlikely (mind me, even the base CVE has a very low severity rating by itself), but it's still possible and valid as a vulnerability, especially when coupled with other attack vectors.
TBH, since it's been confirmed by https://github.com/google/guava/issues/6399#issuecomment-1501962744 that they are working on an actual fix (i.e. removing the method or providing a safe fallback), wouldn't it be better if this wouldn't be suppressed at all?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org