Merge pull request #1717 from finos/bugs/1714-cve-2020-8908

fix(#1714): CVE-2020-8908 Low severity vulnerability in Guava
finos · Jan 8, 2021 · 7bd7f62 · 7bd7f62
2 parents 74cb502 + 851b8e0
commit 7bd7f62
Show file tree

Hide file tree

Showing 5 changed files with 45 additions and 0 deletions.
diff --git a/common/build.gradle b/common/build.gradle
@@ -33,6 +33,15 @@ dependencies {
     compile "com.fasterxml.jackson.core:jackson-databind:${JACKSON_VERSION}"
     compile group: "com.google.inject", name: "guice", version: "${GUICE_VERSION}"
 
+    constraints {
+        compile('com.google.guava:guava:30.0-jre') {
+            because 'Versions prior to 30.0 are impacted by CVE-2020-8908'
+        }
+        compile('com.google.guava:guava:30.0-android') {
+            because 'Versions prior to 30.0 are impacted by CVE-2020-8908'
+        }
+    }
+
     implementation "org.threeten:threeten-extra:${THREE_TEN_VERSION}"
     testCompile "org.junit.jupiter:junit-jupiter-api:${JUNIT_JUPITER_VERSION}"
     testCompile "junit:junit:${JUNIT_4_VERSION}"

diff --git a/core/build.gradle b/core/build.gradle
@@ -27,6 +27,15 @@ dependencies {
         }
     }
 
+    constraints {
+        compile('com.google.guava:guava:30.0-jre') {
+            because 'Versions prior to 30.0 are impacted by CVE-2020-8908'
+        }
+        compile('com.google.guava:guava:30.0-android') {
+            because 'Versions prior to 30.0 are impacted by CVE-2020-8908'
+        }
+    }
+
     testCompile project(":common").sourceSets.test.output
     testCompile "org.junit.jupiter:junit-jupiter-api:${JUNIT_JUPITER_VERSION}"
     testCompile "junit:junit:${JUNIT_4_VERSION}"

diff --git a/output/build.gradle b/output/build.gradle
@@ -20,6 +20,15 @@ dependencies {
     compile "org.apache.commons:commons-csv:${COMMONS_CSV_VERSION}"
     compile "com.google.inject:guice:${GUICE_VERSION}"
 
+    constraints {
+        compile('com.google.guava:guava:30.0-jre') {
+            because 'Versions prior to 30.0 are impacted by CVE-2020-8908'
+        }
+        compile('com.google.guava:guava:30.0-android') {
+            because 'Versions prior to 30.0 are impacted by CVE-2020-8908'
+        }
+    }
+
     testCompile project(":common").sourceSets.test.output
     testCompile "org.junit.jupiter:junit-jupiter-api:${JUNIT_JUPITER_VERSION}"
     testCompile "junit:junit:${JUNIT_4_VERSION}"

diff --git a/playground/build.gradle b/playground/build.gradle
@@ -19,6 +19,15 @@ dependencies {
     testCompile "org.junit.jupiter:junit-jupiter-params:${JUNIT_JUPITER_VERSION}"
     testCompile "org.junit.jupiter:junit-jupiter-engine:${JUNIT_JUPITER_VERSION}"
     testImplementation("org.junit.jupiter:junit-jupiter:${JUNIT_JUPITER_VERSION}")
+
+    constraints {
+        compile('com.google.guava:guava:30.0-jre') {
+            because 'Versions prior to 30.0 are impacted by CVE-2020-8908'
+        }
+        compile('com.google.guava:guava:30.0-android') {
+            because 'Versions prior to 30.0 are impacted by CVE-2020-8908'
+        }
+    }
 }
 
 test {

diff --git a/profile/build.gradle b/profile/build.gradle
@@ -37,6 +37,15 @@ dependencies {
         }
     }
 
+    constraints {
+        compile('com.google.guava:guava:30.0-jre') {
+            because 'Versions prior to 30.0 are impacted by CVE-2020-8908'
+        }
+        compile('com.google.guava:guava:30.0-android') {
+            because 'Versions prior to 30.0 are impacted by CVE-2020-8908'
+        }
+    }
+
     testCompile project(":common").sourceSets.test.output
     testCompile "org.junit.jupiter:junit-jupiter-api:${JUNIT_JUPITER_VERSION}"
     testCompile "junit:junit:${JUNIT_4_VERSION}"