Dependency version updates

Even though this is about a Guava vulnerability, because graphql-java shades the Guava library, vulnerabilities-scanning software is flagging graphql-java as also being vulnerable.

Graphql-java seems to be using few modules of guava the fix for vulnerability in release 20.4 the 20.4 version uses 32.0.0 version of guava which still contains the vulnerablity CVE-2023-2976

I am creating this ticket to ask if you could release a patch version including this update and to use guava versions >=32.0.1 to remove the vulnerablity

The Guava vulnerability reported has been fixed in Guava version >=32.0.1.

CVE-2023-2976 is fixed in 32.0.0, it's just that this version breaks a feature in windows:

Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

As discussed in the official announcement, this project doesn't use the Guava offending classes so the upgrade was mostly done to make security tools happy. The advisory you're pointing to (with your last link) is not related to the case discussed here. Thoughts?

CVE-2023-2976 is fixed in 32.0.0, it's just that this version breaks a feature in windows:

Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

As discussed in the official announcement, this project doesn't use the Guava offending classes so the upgrade was mostly done to make security tools happy. The advisory you're pointing to (with your last link) is not related to the case discussed here. Thoughts?

Thanks that clears everything, But the security tools do not seem to be happy with even 32.0.0 and suggests the versions >=32.0.1 to address the vulnerability :)

@chandakakshat

@chandakakshat that's really feedback that should be sent to the security tool vendor . The graphql-java team might upgrade in the future anyway, but this has zero added value since they were not vulnerable in the first place, and here this is a case of an invalid alert by the security tool. Can you create an issue with the security tool vendor and share the link here?

@bclozel

Thanks @bclozel !

In master we're now using Guava 32.1.1 and this will be included in the next release happening very soon (later this month).

Let me know @chandakakshat how you go with the security tool vendor. We did backport the CVE fix already, however if more people in the community want the patch with >=32.0.1, I am open to the idea if more people ask

@bclozel

Thanks @bclozel !

In master we're now using Guava 32.1.1 and this will be included in the next release happening very soon (later this month).

Let me know @chandakakshat how you go with the security tool vendor. We did backport the CVE fix already, however if more people in the community want the patch with >=32.0.1, I am open to the idea if more people ask

Sure, Thanks @bclozel @dondonz for the help
I've raised an issue with the vendor, lets see how it goes -- awaiting for a reply

@dondonz

Hii @dondonz will we be getting a patch version with >=32.0.1 for 18.x versions ?

The Trivy vulnerability scanner also recommends using a version with >= 32.0.1, as follows:

Java (jar)
==========
Total: 1 (HIGH: 1, CRITICAL: 0)

┌────────────────────────────────────────────────┬───────────────┬──────────┬───────────────────┬────────────────┬───────────────────────────────────────────┐
│                    Library                     │ Vulnerability │ Severity │ Installed Version │ Fixed Version  │                   Title                   │
├────────────────────────────────────────────────┼───────────────┼──────────┼───────────────────┼────────────────┼───────────────────────────────────────────┤
│ com.google.guava:guava (graphql-java-20.4.jar) │ CVE-2023-2976 │ HIGH     │ 32.0.0-jre        │ 32.0.1-android │ insecure temporary directory creation     │
│                                                │               │          │                   │                │ https://avd.aquasec.com/nvd/cve-2023-2976 │
└────────────────────────────────────────────────┴───────────────┴──────────┴───────────────────┴────────────────┴───────────────────────────────────────────┘

Are you planning to release a patch version for 20.4 using Guava version >= 32.0.1?

@brfrn169

@brfrn169 did you report the metadata error to Trivy? I think suggesting 32.0.1-android as a fix version is wrong for two reasons:

32.0.1 doesn't fix the CVE
this changes the variant from -jre to -android

I think it's a good idea to help vendors improve the metadata instead of putting more pressure on maintainers for the wrong reasons (graphql-java is not vulnerable in the first place).

@bclozel

@bclozel Thank you for your advice. Filed in aquasecurity/trivy#4839.

Hey folks thanks for reporting. Although graphql-java is not vulnerable, as a fellow dev I feel your pain of the security scanners. I'll release new versions with updated POMs soon

FYI: Trivy has handled this issue:
https://gitlab.com/gitlab-org/security-products/gemnasium-db/-/issues/236

Thanks.

@brfrn169

@brfrn169 thanks for filing the issue. You've improved the situation for lots of developers.

@brfrn169

Thanks for filing the issue @brfrn169 and glad to see the security team updated their advice. @chandakakshat were you also able to update the security advice for your scanner tool?

@brfrn169

Thanks for filing the issue @brfrn169 and glad to see the security team updated their advice. @chandakakshat were you also able to update the security advice for your scanner tool?

My security scanner apparently does not suggest -android for -jre variant

@dondonz

Hi @dondonz, Can you provide a patch for 18.x version also?
Just in case, I've raised a PR for this solution #3281

@chandakakshat

@chandakakshat yes let's do it, I'd rather keep the scanner happy. I understand how hard it can be to change the scanner rules

@chandakakshat

Thanks @chandakakshat for your PR, I have released 18.7 and it should land in Maven shortly.

Release notes: https://github.com/graphql-java/graphql-java/releases/tag/v18.7

To anyone else reading, we are going to release the v19 and v20 versions as well, we wanted to bundle in an extra 2 bugfixes for v19 and v20.

@chandakakshat

Thanks @chandakakshat for your PR, I have released 18.7 and it should land in Maven shortly.

Release notes: https://github.com/graphql-java/graphql-java/releases/tag/v18.7

To anyone else reading, we are going to release the v19 and v20 versions as well, we wanted to bundle in an extra 2 bugfixes for v19 and v20.

Thank you @dondonz @bclozel, for your support!

Today we released 19.7 and 20.5. Both releases contain Guava 32.1.1 which should be accepted as patched by all security scanners. The previously released 21.0 already contained Guava 32.1.1.

Thanks everyone for raising the issue!

Release notes
https://github.com/graphql-java/graphql-java/releases/tag/v19.7
https://github.com/graphql-java/graphql-java/releases/tag/v20.5

Navigation Menu

Repository navigation

Dependency version updates #3263

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Dependency version updates #3263

Description

Activity

bclozel commented on Jul 4, 2023

chandakakshat commented on Jul 4, 2023

bclozel commented on Jul 4, 2023

dondonz commented on Jul 4, 2023

chandakakshat commented on Jul 5, 2023

chandakakshat commented on Jul 11, 2023

brfrn169 commented on Jul 18, 2023

bclozel commented on Jul 18, 2023

brfrn169 commented on Jul 18, 2023

dondonz commented on Jul 19, 2023

brfrn169 commented on Jul 19, 2023

bclozel commented on Jul 19, 2023

dondonz commented on Jul 20, 2023

chandakakshat commented on Jul 20, 2023

chandakakshat commented on Aug 4, 2023

dondonz commented on Aug 10, 2023

dondonz commented on Aug 15, 2023

chandakakshat commented on Aug 16, 2023

dondonz commented on Aug 31, 2023

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions