Fix security issue of protobuf < 3.19.5

oap-project / raydp

RayDP provides simple APIs for running Spark on Ray and integrating Spark with AI libraries.

Apache License 2.0

293 stars 66 forks source link

Fix security issue of protobuf < 3.19.5 #332

Open jiafuzha opened 1 year ago

jiafuzha commented 1 year ago

There is a security issue report, https://github.com/oap-project/raydp/security/dependabot/6.

Package protobuf

Affected versions >= 3.19.0, < 3.19.5

Patched version 3.19.5

protobuf-cpp and protobuf-python have potential Denial of Service issue

To fix it, we limit protobuf > 3.19.5 and <= 3.20.3