dpa99c / cordova-plugin-firebasex

Cordova plugin for Google Firebase
MIT License
570 stars 457 forks source link

com.google.android.recaptcha:recaptcha:18.1.2 security warning #866

Open kikino1989 opened 3 months ago

kikino1989 commented 3 months ago

We are getting the following security warning regarding the reCAPTCHA Enterprice for Mobile SDK:

_This SDK version has a note from the SDK developer. Here's what the SDK developer told us:

A critical security vulnerability was discovered in reCAPTCHA Enterprise for Mobile. The vulnerability has been patched in the latest SDK release. Customers will need to update their Android application with the reCAPTCHA Enterprise for Mobile SDK, version 18.4.0 or above. We strongly recommend you update to the latest version as soon as possible._

As far as we have been able to find, the only references to that SDK are in the cordvoa-plugin-firebasex plugin.

Great job on this plugin, keep it up.

Environment information Ionic:

Ionic CLI : 7.1.1 (/usr/local/lib/node_modules/@ionic/cli) Ionic Framework : @ionic/angular 5.9.4 @angular-devkit/build-angular : 12.2.18 @angular-devkit/schematics : 12.2.18 @angular/cli : 12.2.18 @ionic/angular-toolkit : 5.0.3

Cordova:

Cordova CLI : 11.1.0 Cordova Platforms : android 12.0.1, browser 6.0.0, ios 7.0.1, windows 7.0.1 (deprecated) Cordova Plugins : cordova-plugin-ionic-webview 5.0.0, (and 22 other plugins)

Utility:

cordova-res : 0.15.4 native-run : 2.0.1

System:

ios-deploy : 1.11.4 ios-sim : 8.0.2 NodeJS : v16.16.0 (/usr/local/bin/node) npm : 10.2.3 OS : macOS Unknown Xcode : Xcode 15.2 Build version 15C500b

anuskaoo commented 3 months ago

I have the same problem. I have read that if you add the line to the bundle.gradle: implementation ‘com.google.android.recaptcha:recaptcha:18.4.0’ It is solved but when I compile, that line disappears so the problem continues. I don't use firebase authentication or recaptcha. Can you help me, please. Thanks

TheNotorius0 commented 3 months ago

Well, that's just a warning, so when the plugin will update to the latest SDK it should disappear, I guess.