Dependency to com.squareup.wire:wire-runtime:2.2.0 with CVEs
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 38/100
Research direction
Start with the cloudfoundry-client dependency declaration linked in the issue and inspect how wire-runtime 2.2.0 is resolved in the Java project. Check whether a newer wire-runtime version is compatible with the client, then verify that the existing build and tests pass; done means the listed CVE-affected version is no longer used.
Written by the indexing model from the issue text.
Description
Dependency Security Scans of our project indicate that through org.cloudfoundry:cloudfoundry-client:5.6.0-RELEASE (most recent version as of writing) the dependency com.squareup.wire:wire-runtime:2.2.0 is declared.
This version is known to be subject to (at least) 3 CVEs (evidence):
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15250
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10237
The most current version of wire-runtime is 4.0.1, dating from December 2021, which apparently has these CVEs fixed.
Is it possible for the project to bump to a newer version to resolve the associated security risks?
- Dominant language
- Java
- Stars
- 334
- Forks
- 319
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from cloudfoundry/cf-java-client
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
cloudfoundry/cf-java-client#1374 ·
-
Integration tests fail: test-service-broker.jar incompatible with java-buildpack v5 (JDK 17 default) Open
Difficulty 2/5 Half a day Newbie friendliness 74/100
cloudfoundry/cf-java-client#1344 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 15/100
cloudfoundry/cf-java-client#1373 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
cloudfoundry/cf-java-client#1370 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 45/100
cloudfoundry/cf-java-client#1367 ·
All issues in cloudfoundry/cf-java-client
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
elastic/gradle-plugins#157 ·
-
enhancement Tools
Difficulty 1/5 Under an hour Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
apache/rocketmq-dashboard#5008 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
DETECT_PARAMETER_NAMES=false silently disables @ConstructorProperties-based Creator detection too Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
FasterXML/jackson-databind#6229 ·