Repository navigation
FR: Update nanopb because of security finding #5191
Description
Feature proposal
- Firebase Component: Core
In our project we use whitesources to find security issues in the code.
We got an security finding in the nanopb library in the newest firebase 6.21.0
https://nvd.nist.gov/vuln/detail/CVE-2020-5235
Could you please update to a nanopb version that fixed this security issue?
Thank you
Activity
paulb777 commentedon Mar 25, 2020
@karlkaminski Thanks for the report. Our nanopb migration is currently pending migrating the Firestore gRPC dependency from a nanopb-dependent version. See #4312.
Once that happens, we'll move the Firebase nanopb version forward.
tereznikov commentedon Apr 7, 2020
@paulb777 What is approximate estimation for merging #4312?
We also use WhiteSource and saw the issue with the nanopb.
paulb777 commentedon Apr 7, 2020
@tereznikov We don't make commitments about future releases, but will work on the nanopb update in the next month or two."
paulb777 commentedon Apr 22, 2020
Now that #4312 has landed, I'm going to pick up the nanopb update project again and try to get it into the next release.