microsoft / microsoft/durabletask-java
durabletask-java: google protobuf version 3.12.0 vulnerability
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 29
- Forks
- 18
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 2
Description
In our azure app, we are noticing a warning message for our orchestrator. We did some diagnostics that pointed us to protobuf-java version 3.12.0 as the culprit. According to synk, this version is vulnerable to DOS attacks. They recommend at least upgrading to version 3.25.5 - https://security.snyk.io/package/maven/com.google.protobuf%3Aprotobuf-java/3.12.0
More specifically, in durabletask-java/azurefunctions/build.gradle, it looks like line 12 uses version 3.12.0. The maven website also lists the vulnerable library in the POM file - https://central.sonatype.com/artifact/com.microsoft/durabletask-azure-functions/overview
I cannot confirm that this only spot that needs fixing so a deeper dive should be done before pushing the fix. I also got some chat gpt recommendations to look into durabletask-protobuf, but I can't confirm if this library is a dependency anywhere so I won't be reporting an issue in that repository at this time.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in durabletask-java/azurefunctions/build.gradle at the version referenced near line 12, then inspect the project dependencies and generated POM to find every protobuf-java reference. Verify that the vulnerable 3.12.0 dependency is upgraded to at least 3.25.5 and confirm the resulting dependency metadata no longer reports the vulnerable version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100