You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@beam.apache.org by "sahmadov (via GitHub)" <gi...@apache.org> on 2023/03/09 16:11:32 UTC
[GitHub] [beam] sahmadov opened a new issue, #25746: Upgrade vendored grpc to eliminate vulnerability from protobuf-java 3.21.1
sahmadov opened a new issue, #25746:
URL: https://github.com/apache/beam/issues/25746
Hi team,
The protobuf-java version that we are currently using in below mentioned gradle has [security vulnerabilities](https://mvnrepository.com/artifact/com.google.protobuf/protobuf-java/3.21.1), is there any plan to update it to latest protobuf-java version which has no vulnerabilities
https://github.com/apache/beam/blob/db8db0b6ed0fe1e4891f207f0f7f811798e54db1/buildSrc/src/main/groovy/org/apache/beam/gradle/GrpcVendoring_1_48_1.groovy#L41
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] Abacn closed issue #25746: Upgrade vendored grpc to eliminate vulnerability from protobuf-java 3.21.1
Posted by "Abacn (via GitHub)" <gi...@apache.org>.
Abacn closed issue #25746: Upgrade vendored grpc to eliminate vulnerability from protobuf-java 3.21.1
URL: https://github.com/apache/beam/issues/25746
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] kennknowles commented on issue #25746: Upgrade vendored grpc to eliminate vulnerability from protobuf-java 3.21.1
Posted by "kennknowles (via GitHub)" <gi...@apache.org>.
kennknowles commented on issue #25746:
URL: https://github.com/apache/beam/issues/25746#issuecomment-1462641295
The CVEs associated with that version of protobuf-java are not exploitable in Beam. We should update anyhow to keep on top of upgrades.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] sahmadov closed issue #25746: Protobuf-java 3.21.1 version update
Posted by "sahmadov (via GitHub)" <gi...@apache.org>.
sahmadov closed issue #25746: Protobuf-java 3.21.1 version update
URL: https://github.com/apache/beam/issues/25746
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] aaltay commented on issue #25746: Upgrade vendored grpc to eliminate vulnerability from protobuf-java 3.21.1
Posted by "aaltay (via GitHub)" <gi...@apache.org>.
aaltay commented on issue #25746:
URL: https://github.com/apache/beam/issues/25746#issuecomment-1515663279
Could we close this issue now?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] Abacn commented on issue #25746: Protobuf-java 3.21.1 version update
Posted by "Abacn (via GitHub)" <gi...@apache.org>.
Abacn commented on issue #25746:
URL: https://github.com/apache/beam/issues/25746#issuecomment-1458847846
Thanks for raising this. The code path is vendored grpc dependency. Its protobuf dependency is shaded. It is not the version used in Beam. In Beam we regularly updates protobuf version via GCP cloud libraries BOM. The latest update is in #25194, with protobuf v3.21.12. will be available in upcoming Beam v2.46.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] pabloem commented on issue #25746: Upgrade vendored grpc to eliminate vulnerability from protobuf-java 3.21.1
Posted by "pabloem (via GitHub)" <gi...@apache.org>.
pabloem commented on issue #25746:
URL: https://github.com/apache/beam/issues/25746#issuecomment-1462644392
maybe we need to explain why it's not exploitable?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] Abacn commented on issue #25746: Upgrade vendored grpc to eliminate vulnerability from protobuf-java 3.21.1
Posted by "Abacn (via GitHub)" <gi...@apache.org>.
Abacn commented on issue #25746:
URL: https://github.com/apache/beam/issues/25746#issuecomment-1517219241
@sahmadov v2.48.0 is scheduled to release late June.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] Abacn commented on issue #25746: Upgrade vendored grpc to eliminate vulnerability from protobuf-java 3.21.1
Posted by "Abacn (via GitHub)" <gi...@apache.org>.
Abacn commented on issue #25746:
URL: https://github.com/apache/beam/issues/25746#issuecomment-1515676775
@aaltay there is one last step that is switch to use grpcv1p54p0 in Beam. Will close this issue once it is done.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] kennknowles commented on issue #25746: Upgrade vendored grpc to eliminate vulnerability from protobuf-java 3.21.1
Posted by "kennknowles (via GitHub)" <gi...@apache.org>.
kennknowles commented on issue #25746:
URL: https://github.com/apache/beam/issues/25746#issuecomment-1462649647
Sure - the CVE is that a particular message could cause sufficient GC in protobuf-java to constitute a DoS attack. We use vendored gRPC only for communication with other fully trusted parties.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] abgm commented on issue #25746: Upgrade vendored grpc to eliminate vulnerability from protobuf-java 3.21.1
Posted by "abgm (via GitHub)" <gi...@apache.org>.
abgm commented on issue #25746:
URL: https://github.com/apache/beam/issues/25746#issuecomment-1471856879
This is a recursive issue on Beam.
Can we create version of this lib without it be a uber-jar/fat-jar? ( we can even create a different artifactId )
I'm not sure why the lib needs to be an uber-jar. But to be used on beam we shouldn't need it to be uber-jar. And that way the clients can control the version of the dependencies.
This is the contents of the uber-jar.
```
com.google.api.grpc_proto-google-common-protos 2.9.0
com.google.auth_google-auth-library-credentials 1.4.0
com.google.code.gson_gson 2.9.0
com.google.errorprone_error_prone_annotations 2.14.0
com.google.protobuf_protobuf-java 3.21.1
com.google.protobuf_protobuf-java-util 3.21.1
io.netty_netty-buffer 4.1.77
io.netty_netty-codec 4.1.77
io.netty_netty-codec-http 4.1.77
io.netty_netty-codec-http2 4.1.77
io.netty_netty-codec-socks 4.1.77
io.netty_netty-common 4.1.77
io.netty_netty-handler 4.1.77
io.netty_netty-handler-proxy 4.1.77
io.netty_netty-resolver 4.1.77
io.netty_netty-tcnative-boringssl-static 2.0.53
io.netty_netty-tcnative-classes 2.0.53
io.netty_netty-transport 4.1.77
io.netty_netty-transport-classes-epoll 4.1.77
io.netty_netty-transport-native-epoll 4.1.77
io.netty_netty-transport-native-unix-common 4.1.77
org.apache.beam_grpc-1_48_1 0.1
org.codehaus.mojo_animal-sniffer-annotations 1.21
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] Abacn commented on issue #25746: Protobuf-java 3.21.1 version update
Posted by "Abacn (via GitHub)" <gi...@apache.org>.
Abacn commented on issue #25746:
URL: https://github.com/apache/beam/issues/25746#issuecomment-1461100323
Thanks, will try to do in Q2.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] sagarkate commented on issue #25746: Protobuf-java 3.21.1 version update
Posted by "sagarkate (via GitHub)" <gi...@apache.org>.
sagarkate commented on issue #25746:
URL: https://github.com/apache/beam/issues/25746#issuecomment-1459526536
@Abacn - Thank you Yi Hu for looking into this issue!
We are using [beam-runner-google-cloud-dataflow-java-2.45.0](https://mvnrepository.com/artifact/org.apache.beam/beam-runners-google-cloud-dataflow-java/2.45.0) dependency in our code.
This runner has [beam-vendor-grpc-1-48-1](https://mvnrepository.com/artifact/org.apache.beam/beam-runners-google-cloud-dataflow-java/2.45.0#:~:text=org.apache.beam%20%C2%BB%20beam%2Dvendor%2Dgrpc%2D1_48_1) as its compile time dependency.
The protobuf-java-3.21.1 is shaded into this beam-vendor-grpc-1-48-1-0-1. So, we cannot exclude protobuf-java-3.21.1 from this vendor jar and we cannot even override it with the latest version of protobuf-java version either.
We cannot use any other beam-vendor-grpc version as beam-vendor-grpc-1-48-1-0-1 is the latest version.
We cannot exclude beam-vendor-grpc because internally dataflow runner references classes from beam-vendor-grpc-1-48-1 such as org.apache.beam.vendor.grpc.v1p48p1.com.google.protobuf.Message$Builder.
And, if we include this vendor jar, it gets flagged vulnerable by our security scan due to shaded protobuf-java.3.21.1.
Hence, it would be really helpful if the version of protobuf-java is updated to its latest version in beam-vendor-grpc-1-48-1.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] Abacn commented on issue #25746: Upgrade vendored grpc to eliminate vulnerability from protobuf-java 3.21.1
Posted by "Abacn (via GitHub)" <gi...@apache.org>.
Abacn commented on issue #25746:
URL: https://github.com/apache/beam/issues/25746#issuecomment-1462337499
We can keep this issue open to track the vendor grpc upgrade
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [beam] sahmadov commented on issue #25746: Upgrade vendored grpc to eliminate vulnerability from protobuf-java 3.21.1
Posted by "sahmadov (via GitHub)" <gi...@apache.org>.
sahmadov commented on issue #25746:
URL: https://github.com/apache/beam/issues/25746#issuecomment-1517037900
Thanks everyone for the effort that you guys put for resolving the issue.
do you guys happen to know expected release date?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@beam.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org