search

vitalidze / chromecast-java-api-v2

Java implementation of ChromeCast V2 protocol client
Apache License 2.0
264 stars 77 forks source link

Upgrade protobuf-java to fix CVE-2015-5237 #121

Closed wborn closed 4 years ago

wborn commented 4 years ago

Hi @vitalidze did you ever test using the protobuf-java 3.x libraries? According to the docs it should be compatible with proto2. I just regenerated CastChannel using a recent protoc and gave it a brief test with 3.10.0. So far it seems to work without issues. :-)

Upgrading this dependency would prevent the CVE-2015-5237 vulnerability which is identified for instance by Snyk (https://github.com/openhab/openhab2-addons/pull/6442).

There's also a lite version that's more compatible with Android but it has some limitations, see: https://github.com/protocolbuffers/protobuf/blob/master/java/lite.md .

vitalidze commented 4 years ago

@wborn thank you for bringing my attention to this!

No, I haven't tested the 3.x protobuf. But I would like to avoid such changes until the library becomes modular/pluggable (i.e. you will be able to choose either 2.x or 3.x protobuf for example) since it may break the compatibility with some projects. I have started working on the topic some time ago to make jmdns optional with the possibility to switch implementations.

Regarding the particular CVE-2015-5237 [the thread|https://github.com/protocolbuffers/protobuf/issues/760] says that it was introduced in 3.4.0 only and is actually related with big messages (>2G or >4G). Is this even the case for openhab? Do you have a use case when you will be sending such a big messages? I am just trying to figure out the real use case of exploiting the vulnerability.

Let me know your thoughts.

wborn commented 4 years ago

Yes I think you may be right that there isn't much of an issue. To me it looks like this is only an issue for the generated C code which we aren't using. So it seems like a false positive by Snyk for Java . I'll close this issue!

djmuhlestein commented 3 years ago

IDK if the CVE is an issue or not, but the 2.6.0 dependency is an issue if you want to use this library in Android projects that have other dependencies w/ a conflicting version.

Example: com.google.firebase:firebase-firestore -> recent versions depend on protobuf-javalite and pull in version 3.11.0. Which yields duplicate class errors during build. I tried manually excluding one or the other dependencies but the result was whichever library excluded it's dependency then wasn't compatible with the other library dependency.