futurewei-cloud / alcor

Alcor: Cloud native SDN platform powered by Kubernetes and Istio
MIT License
32 stars 33 forks source link

[Dependency] Upgrade guava package to 30.0+ #714

Closed xieus closed 2 years ago

xieus commented 2 years ago

Upgrade com.google.guava:guava to version 30.0-jre or later to address some potential security concern.

Warning message from GitHub: A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend updating Guava to version 30.0 or later, or update to Java 7 or later, or to explicitly change the permissions after the creation of the directory if neither are possible.

pkommoju commented 2 years ago

Has it been validated, what other dependencies is it bringing in etc? Should I validate it Jenkins before the merge?