bytedeco/javacv

Dependencies check

Open

#2,051 opened on Jun 29, 2023

View on GitHub
 (1 comment) (0 reactions) (0 assignees)Java (1,583 forks)batch import
enhancementhelp wanted

Repository metrics

Stars
 (6,985 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

avaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the bytedeco/javacpp-presets use the github.event.head_commit.message? parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.

Upgrading to 1.5.9 still has dependency security issues

https://nvd.nist.gov/vuln/detail/CVE-2023-34112

Contributor guide

Research direction
Upgrade the affected dependency (javacpp presets) to version 1.5.9 or later, then verify that the CVE 2023-34112 fix is applied and no new dependency issues arise.
Tech stack
java
Domain
securitydevops
Issue type
Security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
JavaGitSecurity basics
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40