Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New release to mitigate dependency vulnerabilities #656

Closed
ulvii opened this issue Feb 20, 2020 · 1 comment
Closed

New release to mitigate dependency vulnerabilities #656

ulvii opened this issue Feb 20, 2020 · 1 comment

Comments

@ulvii
Copy link

ulvii commented Feb 20, 2020

Hi team,

Our Component Governance tool detects a medium severity vulnerability for com.microsoft.rest:client-runtime:1.7.0 because it uses com.google.guava:guava:20.0.

Below is the description:

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

We are requesting a release that will update the dependency version to latest to mitigate the issue. It is also a good idea to update all dependencies to their latest versions.

Related to #641 .

@jianghaolu
Copy link
Contributor

Thanks! Closed via #655

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants