[Bug] Security scanner flags vulnerable Guava 31.1-android in firebase-analytics (even in v24.0.0)
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start by tracing the dependency declarations for firebase-analytics and play-services-measurement-impl in the repository, then check how their published dependency versions are managed. Confirm whether the Guava version can be updated safely across the affected artifacts; done means the dependency tree resolves to a patched Guava version and the affected SDK builds and tests pass.
由索引模型根据 Issue 内容生成。
描述
Description:
When generating an SBOM and running a security scan using Grype, the build fails due to a vulnerable version of Guava (31.1-android) being pulled in transitively by firebase-analytics.
I am currently using firebase-bom: 33.9.0, which resolves firebase-analytics to 22.2.0. I noticed a similar report in #7583, but I want to highlight that simply updating to the latest firebase-analytics: 24.0.0 does not resolve this issue, as its underlying play-services-measurement-impl dependency still relies on the same vulnerable Guava version.
Vulnerabilities Flagged (Grype):
GHSA-xxph-c9ww-hj94 (High) - CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocation
GHSA-7g45-4rm6-3mm3 (Medium) - Insecure use of temporary directory
GHSA-5mg8-w23w-74h3 (Low) - Information Disclosure in Guava
Dependency Tree Context:
+--- com.google.firebase:firebase-analytics:22.2.0 (and 24.0.0)
| +--- com.google.android.gms:play-services-measurement:22.2.0 (and 24.0.0)
| | +--- com.google.android.gms:play-services-measurement-impl:22.2.0 (and 24.0.0)
| | | \--- com.google.guava:guava:31.1-android
Expected Behavior:
The Firebase Android SDK and its underlying Google Play Services dependencies should use a patched version of Guava (such as 33.7.2-android) to prevent CI/CD security scanners from blocking app releases.
Actual Behavior:
The SDK pulls in Guava 31.1-android, forcing developers to manually implement project-wide dependency constraints to override the version and clear security warnings.
Environment:
Firebase BOM: 33.9.0
Firebase Analytics: 22.2.0 (also verified issue exists in 24.0.0)
Scanner: Grype 0.121.0
- 主要语言
- Java
- 星标
- 2.6k
- 派生
- 733
- 平均合并
- 2 天 15 小时
- 30 天内合并 PR
- 72
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
firebase/firebase-android-sdk 的其他 Issue
-
api: remoteconfig
难度 2/5 1-3 小时 新手友好度 78/100
firebase/firebase-android-sdk#8827 ·
维护者通常 1 天内回复
-
Crashlytics plugin writes build ID lists in directory listing order, so APKs can differ between machines可能已有人在做 @mrober 于 8 天前认领。 未关闭api: crashlytics
难度 2/5 1-3 小时 新手友好度 72/100
firebase/firebase-android-sdk#8789 · 1 条评论 · 已指派 1 人 ·
维护者通常 1 天内回复
-
api: auth
难度 2/5 1-3 小时 新手友好度 68/100
firebase/firebase-android-sdk#8505 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 15/100
firebase/firebase-android-sdk#8835 ·
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 25/100
firebase/firebase-android-sdk#8832 ·
维护者通常 1 天内回复
查看 firebase/firebase-android-sdk 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 65/100
NationalSecurityAgency/ghidra#10220 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 80/100
维护者通常 1 天内回复
-
RIS export splits an organization name containing “and” into multiple authors可能已有人在做 @Gautam-aman 今天认领。 未关闭status: needs-triage
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
FailureContext.java rounds down thresholds in lastedAtLeast()可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复