search

tensorflow / java

Java bindings for TensorFlow
Apache License 2.0
813 stars 200 forks source link

protobuf-java 3.19.4 contains 3 high vulnerabilities #493

Closed hamoid closed 4 months ago

hamoid commented 1 year ago

The latest available tensorflow-java package (0.5.0) depends on protobuf-java 3.19.4, which has 3 vulnerabilities. 

Here the line listing the dependency:

https://github.com/tensorflow/java/blob/560e8770a37f6d9e4c53cdd3c0d5fc6d2df5f011/tensorflow-core/pom.xml#L46

Here a list of alternative versions and the number of known vulnerabilities in each:

https://mvnrepository.com/artifact/com.google.protobuf/protobuf-java

(I'm not posting this on the google bugs platform because I don't have an account there)

karllessard commented 1 year ago

Thanks for reporting @hamoid , I think it should be safe to upgrade to 3.19.6 (we need to be careful not upgrading too much as TensorFlow runtime still uses very old versions). I'll check if that can be part of the next planned release to support TF 2.12 or if that should be done later.

karllessard commented 1 year ago

Oh, apparently they did quite a jump between 2.10 and 2.12 (protobuf 3.9.2 -> 3.21.9), so we'll follow that as well if we wait for the next release.

Craigacp commented 4 months ago

Latest release uses protobuf 3.21.9.