[BIGTOP-3671] Add a patch for CVE-2021-22569 to bigtop_toolchain

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.1.0
• Component/s: toolchain
• Assignee: Masatake Iwasaki
• Reporter: Masatake Iwasaki
• Created: 21/Apr/22 06:33
• Updated: 26/Apr/22 07:32
• Resolved: 25/Apr/22 13:09

Description

PR#9371 of protobuf is the fix for vulnerability of protobuf-java. apurtell provided us a backported patch for protobuf-2.5.0. Users can locally install patched protobuf-java from the source code set up by bigtop_toolchain (under /usr/src/protobuf-2.5.0/java) for their own build.

Using patched protobuf-java for packaging is out of the scope of this issue. We are using only protoc and protobuf-java is pulled from public Maven repos now. It may be addressed in follow-up JIRAs.

Issue Links

• links to: GitHub pull request #888