-
Notifications
You must be signed in to change notification settings - Fork 323
Open
Labels
dependenciesPull requests that update a dependency filePull requests that update a dependency filetriagedInitial triage of issue has been performedInitial triage of issue has been performed
Description
Dependency Security Scans of our project indicate that through org.cloudfoundry:cloudfoundry-client:5.6.0-RELEASE
(most recent version as of writing) the dependency com.squareup.wire:wire-runtime:2.2.0
is declared.
This version is known to be subject to (at least) 3 CVEs (evidence):
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15250
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10237
The most current version of wire-runtime
is 4.0.1, dating from December 2021, which apparently has these CVEs fixed.
Is it possible for the project to bump to a newer version to resolve the associated security risks?
Metadata
Metadata
Assignees
Labels
dependenciesPull requests that update a dependency filePull requests that update a dependency filetriagedInitial triage of issue has been performedInitial triage of issue has been performed