googleapis / googleapis/python-aiplatform

protobuf 5.29.5 reported as vulnerable

Ouverte
#5,451 0 commentaires 2 réactions 0 personnes assignées Voir sur GitHub
api: vertex-ai
Langage dominant
Python
Étoiles
905
Forks
465
Merge moyen
1 j 13 h
PR mergées (30 j)
44

Description

protobuf 5.29.5 reported as vulnerable

#### Environment details

- OS type and version: macos 15.5
- Python version: 3.12.2
- pip version: 25.0.1
- `google-cloud-aiplatform` version: Version: 1.71.1

#### Steps to reproduce

1. pip install vertexai==1.71.1
2. pip install google-generativeai==0.8.5
3. pip show protobuf (it will show 5.29.5) which is vulnerable.

Description
Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901

however vertexai library supports only upto 5.29.5.
one of my projcet has recived vulnerability issue because of this and cannot move ahead.

https://nvd.nist.gov/vuln/detail/CVE-2025-4565
it has CVSS-B [8.2 HIGH]

let me know if this will be updated soon.
Thanks

Thanks!

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.