-
Notifications
You must be signed in to change notification settings - Fork 28
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Guava Transitive Dependency CVE-2023-2976 #712
Comments
Thanks for filing this issue! Adding in some notes from initial analysis: However, running
|
@mmastika Please try version 3.6.1 that was released from the spring-cloud-gcp repo. Future releases of cloud-spanner-spring-data-r2dbc will be published from spring-cloud-gcp. Please also file an issue in that repository, if the new version doesn't help. |
Hi @meltsufin , Thanks for the help. I've attempted to upgrade and it doesn't work. I've also commented here, apparently it's an issue spring-cloud-gcp/issues/2084. As a side note, will there be a work to remove this repository? Currently the experience to develop using Google product GCP is not very pleasant. One of the major issue is caused by the outdated information scattered on the internet. |
No plans to remove this repository. We're just migrating the Spring-related module to the Spring Cloud GCP repository where it fits better. We're actively investigating the Guava Gradle issue. Say tuned. |
Hi,
I'm using:
com.google.cloud:cloud-spanner-spring-data-r2dbc:1.2.2
which is affected by CVE-2023-2976 which is subsequently addressed in google/guava#2575. The transitive dependency which brings in the affected guava is from com.google.cloud:google-cloud-spanner:6.42.3.Forcefully updating/constraining the dependency to com.google.cloud:google-cloud-spanner:6.43.2 results in:
Requesting some help to address the CVE.
The text was updated successfully, but these errors were encountered: