Upgrade OkHttp to resolve CVE-2023-3635

hotwired / turbo-android

Android framework for making Turbo native apps

MIT License

407 stars 51 forks source link

Upgrade OkHttp to resolve CVE-2023-3635 #328

Closed guillermoAMS closed 2 months ago

guillermoAMS commented 3 months ago

Turbo v7.1.2 uses com.squareup.okhttp3:okhttp:4.11.0 which in turn has the compile dependency com.squareup.okio:okio:3.2.0. (https://mvnrepository.com/artifact/com.squareup.okhttp3/okhttp/4.11.0).

The CVE-2023-3635 reported a vulnerability on Okio v3.2.0 to a DoS. The issue was fixed at Okio v3.4.0 and the lates version of OkHttp (which is v4.12.0) uses Okio v3.6.0.

Can we get a bump to com.squareup.okhttp3:okhttp:4.120?

felipejoglar commented 2 months ago

Hi!

I don't know when this upgrade will take effect, and I guess it will eventually.

In the meantime, if you have any concerns, maybe you address them by overriding transitive dependency versions in your build.gradle file.