durabletask-java: google protobuf version 3.12.0 vulnerability
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
Research direction
Start in durabletask-java/azurefunctions/build.gradle at the version referenced near line 12, then inspect the project dependencies and generated POM to find every protobuf-java reference. Verify that the vulnerable 3.12.0 dependency is upgraded to at least 3.25.5 and confirm the resulting dependency metadata no longer reports the vulnerable version.
Written by the indexing model from the issue text.
Description
In our azure app, we are noticing a warning message for our orchestrator. We did some diagnostics that pointed us to protobuf-java version 3.12.0 as the culprit. According to synk, this version is vulnerable to DOS attacks. They recommend at least upgrading to version 3.25.5 - https://security.snyk.io/package/maven/com.google.protobuf%3Aprotobuf-java/3.12.0
More specifically, in durabletask-java/azurefunctions/build.gradle, it looks like line 12 uses version 3.12.0. The maven website also lists the vulnerable library in the POM file - https://central.sonatype.com/artifact/com.microsoft/durabletask-azure-functions/overview
I cannot confirm that this only spot that needs fixing so a deeper dive should be done before pushing the fix. I also got some chat gpt recommendations to look into durabletask-protobuf, but I can't confirm if this library is a dependency anywhere so I won't be reporting an issue in that repository at this time.
- Dominant language
- Java
- Stars
- 29
- Forks
- 18
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/durabletask-java
-
Needs: Triage :mag:
Difficulty 4/5 3-5 days Newbie friendliness 48/100
microsoft/durabletask-java#303 ·
-
Needs: Triage :mag:
Difficulty 4/5 3-5 days Newbie friendliness 45/100
microsoft/durabletask-java#290 · 2 comments ·
-
Needs: Triage :mag:
Difficulty 5/5 Over a week Newbie friendliness 35/100
microsoft/durabletask-java#285 ·
-
Needs: Triage :mag:
Difficulty 3/5 1-2 days Newbie friendliness 68/100
microsoft/durabletask-java#276 ·
-
Enhancement
microsoft/durabletask-java#274 · 1 reaction · 2 assignees ·
All issues in microsoft/durabletask-java
Similar issues
-
bug untriaged
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
opensearch-project/ml-commons#5094 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
emitter:client:csharp feature
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
affects/8.10 affects/8.9 component/clients kind/bug likelihood/mid severity/mid
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Two open-case totals on one screen: the Programs tile says 15,858 and the nav badge says 15,868 Openbug frontend maui-pilot
Difficulty 2/5 1-3 hours Newbie friendliness 72/100