search

DataDog / dd-sdk-android

Datadog SDK for Android (Compatible with Kotlin and Java)
Apache License 2.0
146 stars 59 forks source link

Security vulnerability introduced with SDK v2.7.1 (okio) #1984

Closed tobi512 closed 4 months ago

tobi512 commented 4 months ago

Question

Hi guys, we recently updated your SDK version (dd-sdk-android) to v2.7.1 and our security vulnerability tool Snyk now reports 2 vulnerabilities introduced by your SDK.

CVE is CVE-2023-3635 Bildschirmfoto 2024-04-12 um 11 28 02

The affected dependency is "com.squareup.okio", however it's not obvious which version exactly is used. Updating it to v3.4.0 or higher would fix the problem. Can you please check the usage of the dependency in your SDK and give us a fixed version or detailed information on how to get rid of the vulnerability?

Cheers, Tobias

xgouchet commented 4 months ago

Hi @tobi512 , thanks a lot for opening this question.

The vulnerability you're linking to is only relevant when Okio is used in a server to process incoming gzipped requests, which could lead to a Denial of Service. In our case, the SDK is embedded in a mobile app that isn't a server, and this vulnerability doesn't apply, so you can ignore this warning.

tobi512 commented 4 months ago

Merci beaucoup! @xgouchet