[ATLAS-4925] Upgrade protobuf-java to 3.25.5/4.27.5/4.28.2 - ASF JIRA

Attach files

Attach Screenshot

Voters

Watch issue

Watchers

Create sub-task

Link

Clone

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: Task
Status: Resolved
Priority: Major
Resolution: Fixed
Affects Version/s: None
Fix Version/s: None
Component/s: atlas-core
Labels:
None

Description

Upgrade protobuf-java to 3.25.5/4.27.5/4.28.2

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

https://security.snyk.io/vuln/SNYK-JAVA-COMGOOGLEPROTOBUF-8055227

https://nvd.nist.gov/vuln/detail/CVE-2024-7254

https://github.com/advisories/GHSA-735f-pc8j-v9w8