Skip to content
This repository was archived by the owner on Mar 31, 2023. It is now read-only.

Conversation

@xieus
Copy link
Contributor

@xieus xieus commented Dec 10, 2021

Upgrade com.google.guava:guava to version 30.0-jre or later to address some potential security concern.

Warning message from GitHub:
A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend updating Guava to version 30.0 or later, or update to Java 7 or later, or to explicitly change the permissions after the creation of the directory if neither are possible.

@xieus xieus added the dependencies Pull requests that update a dependency file label Dec 10, 2021
@xieus xieus added this to the Version 1.0.2021.12.30 milestone Dec 10, 2021
@xieus xieus self-assigned this Dec 10, 2021
@pkommoju
Copy link
Contributor

Has it been validated, what other dependencies is it bringing in etc?
Should I validate it Jenkins before the merge?

Copy link
Contributor

@pkommoju pkommoju left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Passed in Jenkins.

Copy link
Contributor

@cj-chung cj-chung left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@xieus xieus merged commit d3354de into futurewei-cloud:master Dec 10, 2021
@xieus xieus deleted the dependencies/fix branch December 10, 2021 20:43
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants