[Bug] Security scanner flags vulnerable Guava 31.1-android in firebase-analytics (even in v24.0.0)

Abierto
  • ¿Algo no está bien?
#8,770 1 comentario 2 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
48/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
android, java
Área
backend, security

Línea de trabajo

Start by tracing the dependency declarations for firebase-analytics and play-services-measurement-impl in the repository, then check how their published dependency versions are managed. Confirm whether the Guava version can be updated safely across the affected artifacts; done means the dependency tree resolves to a patched Guava version and the affected SDK builds and tests pass.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

api: analytics
Description:

When generating an SBOM and running a security scan using Grype, the build fails due to a vulnerable version of Guava (31.1-android) being pulled in transitively by firebase-analytics.

I am currently using firebase-bom: 33.9.0, which resolves firebase-analytics to 22.2.0. I noticed a similar report in #7583, but I want to highlight that simply updating to the latest firebase-analytics: 24.0.0 does not resolve this issue, as its underlying play-services-measurement-impl dependency still relies on the same vulnerable Guava version.

Vulnerabilities Flagged (Grype):

GHSA-xxph-c9ww-hj94 (High) - CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation

GHSA-7g45-4rm6-3mm3 (Medium) - Insecure use of temporary directory

GHSA-5mg8-w23w-74h3 (Low) - Information Disclosure in Guava

Dependency Tree Context:
+--- com.google.firebase:firebase-analytics:22.2.0 (and 24.0.0)
|    +--- com.google.android.gms:play-services-measurement:22.2.0 (and 24.0.0)
|    |    +--- com.google.android.gms:play-services-measurement-impl:22.2.0 (and 24.0.0)
|    |    |    \--- com.google.guava:guava:31.1-android
Expected Behavior:

The Firebase Android SDK and its underlying Google Play Services dependencies should use a patched version of Guava (such as 33.7.2-android) to prevent CI/CD security scanners from blocking app releases.

Actual Behavior:

The SDK pulls in Guava 31.1-android, forcing developers to manually implement project-wide dependency constraints to override the version and clear security warnings.

Environment:

Firebase BOM: 33.9.0

Firebase Analytics: 22.2.0 (also verified issue exists in 24.0.0)

Scanner: Grype 0.121.0

Lenguaje dominante
Java
Estrellas
2.6k
Forks
733
Merge medio
2 d 15 h
PR fusionados (30 d)
72

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de firebase/firebase-android-sdk

Todos los issues de firebase/firebase-android-sdk

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.