Skip to content
This repository has been archived by the owner on Oct 18, 2024. It is now read-only.

fix(deps): update dependency com.google.guava:guava to v32 [security] #1446

Merged
merged 1 commit into from
Dec 1, 2023
Merged

fix(deps): update dependency com.google.guava:guava to v32 [security] #1446

merged 1 commit into from
Dec 1, 2023

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Nov 10, 2023 •
edited
Loading

Mend Renovate logo banner

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
com.google.guava:guava 31.1-android -> 32.0.0-android age adoption passing confidence

Information Disclosure in Guava

CVE-2020-8908 / GHSA-5mg8-w23w-74h3 / SNYK-JAVA-COMGOOGLEGUAVA-1015415

More information

Details

A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.

Severity

  • CVSS Score: 3.3 / 10 (Low)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Guava vulnerable to insecure use of temporary directory

CVE-2023-2976 / GHSA-7g45-4rm6-3mm3

More information

Details

Use of Java's default temporary directory for file creation in FileBackedOutputStream in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.

Even though the security vulnerability is fixed in version 32.0.0, maintainers recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

Severity

  • CVSS Score: 5.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Nov 10, 2023
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed Nov 10, 2023
@renovate renovate bot closed this Nov 10, 2023
@renovate renovate bot deleted the renovate/maven-com.google.guava-guava-vulnerability branch November 10, 2023 13:58
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed fix(deps): update dependency com.google.guava:guava to v32 [security] Nov 10, 2023
@renovate renovate bot reopened this Nov 10, 2023
@renovate renovate bot restored the renovate/maven-com.google.guava-guava-vulnerability branch November 10, 2023 22:26
@renovate renovate bot force-pushed the renovate/maven-com.google.guava-guava-vulnerability branch from a7f853d to 645aee3 Compare November 10, 2023 22:27
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed Nov 11, 2023
@renovate renovate bot closed this Nov 11, 2023
@renovate renovate bot deleted the renovate/maven-com.google.guava-guava-vulnerability branch November 11, 2023 01:58
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed fix(deps): update dependency com.google.guava:guava to v32 [security] Nov 12, 2023
@renovate renovate bot reopened this Nov 12, 2023
@renovate renovate bot restored the renovate/maven-com.google.guava-guava-vulnerability branch November 12, 2023 21:05
@renovate renovate bot force-pushed the renovate/maven-com.google.guava-guava-vulnerability branch from 645aee3 to 6d05b7e Compare November 12, 2023 21:05
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed Nov 13, 2023
@renovate renovate bot closed this Nov 13, 2023
@renovate renovate bot deleted the renovate/maven-com.google.guava-guava-vulnerability branch November 13, 2023 04:08
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed fix(deps): update dependency com.google.guava:guava to v32 [security] Nov 13, 2023
@renovate renovate bot reopened this Nov 13, 2023
@renovate renovate bot restored the renovate/maven-com.google.guava-guava-vulnerability branch November 13, 2023 07:52
@renovate renovate bot force-pushed the renovate/maven-com.google.guava-guava-vulnerability branch from 6d05b7e to d3697c3 Compare November 13, 2023 07:52
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed Nov 13, 2023
@renovate renovate bot closed this Nov 13, 2023
@renovate renovate bot deleted the renovate/maven-com.google.guava-guava-vulnerability branch November 13, 2023 11:26
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed fix(deps): update dependency com.google.guava:guava to v32 [security] Nov 13, 2023
@renovate renovate bot reopened this Nov 13, 2023
@renovate renovate bot restored the renovate/maven-com.google.guava-guava-vulnerability branch November 13, 2023 19:48
@renovate renovate bot force-pushed the renovate/maven-com.google.guava-guava-vulnerability branch from d3697c3 to 89e8d03 Compare November 13, 2023 19:48
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed Nov 14, 2023
@renovate renovate bot closed this Nov 28, 2023
@renovate renovate bot deleted the renovate/maven-com.google.guava-guava-vulnerability branch November 28, 2023 01:44
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed fix(deps): update dependency com.google.guava:guava to v32 [security] Nov 28, 2023
@renovate renovate bot restored the renovate/maven-com.google.guava-guava-vulnerability branch November 28, 2023 11:16
@renovate renovate bot reopened this Nov 28, 2023
@renovate renovate bot force-pushed the renovate/maven-com.google.guava-guava-vulnerability branch from fcf7053 to 716c6b3 Compare November 28, 2023 11:16
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed Nov 28, 2023
@renovate renovate bot closed this Nov 28, 2023
@renovate renovate bot deleted the renovate/maven-com.google.guava-guava-vulnerability branch November 28, 2023 14:48
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed fix(deps): update dependency com.google.guava:guava to v32 [security] Nov 29, 2023
@renovate renovate bot reopened this Nov 29, 2023
@renovate renovate bot restored the renovate/maven-com.google.guava-guava-vulnerability branch November 29, 2023 13:31
@renovate renovate bot force-pushed the renovate/maven-com.google.guava-guava-vulnerability branch from 716c6b3 to 0eacdc3 Compare November 29, 2023 13:31
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed Nov 29, 2023
@renovate renovate bot closed this Nov 29, 2023
@renovate renovate bot deleted the renovate/maven-com.google.guava-guava-vulnerability branch November 29, 2023 16:51
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed fix(deps): update dependency com.google.guava:guava to v32 [security] Nov 30, 2023
@renovate renovate bot reopened this Nov 30, 2023
@renovate renovate bot restored the renovate/maven-com.google.guava-guava-vulnerability branch November 30, 2023 22:37
@renovate renovate bot force-pushed the renovate/maven-com.google.guava-guava-vulnerability branch from 0eacdc3 to 1e0b0d6 Compare November 30, 2023 22:37
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed Dec 1, 2023
@renovate renovate bot closed this Dec 1, 2023
@renovate renovate bot deleted the renovate/maven-com.google.guava-guava-vulnerability branch December 1, 2023 00:29
@renovate renovate bot changed the title fix(deps): update dependency com.google.guava:guava to v32 [security] - autoclosed fix(deps): update dependency com.google.guava:guava to v32 [security] Dec 1, 2023
@renovate renovate bot reopened this Dec 1, 2023
@renovate renovate bot restored the renovate/maven-com.google.guava-guava-vulnerability branch December 1, 2023 17:48
@renovate renovate bot force-pushed the renovate/maven-com.google.guava-guava-vulnerability branch from 1e0b0d6 to 60c62d3 Compare December 1, 2023 17:48
@itsaky itsaky merged commit bd88b54 into dev Dec 1, 2023
6 checks passed
@renovate renovate bot deleted the renovate/maven-com.google.guava-guava-vulnerability branch December 1, 2023 18:06
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@itsaky