-
Notifications
You must be signed in to change notification settings - Fork 10.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CVE-2023-2976 in version 32.0.0 #6532
Comments
Hmm, thanks. Do you know where OWASP gets its data? I went from https://owasp.org/www-project-dependency-check/ to https://search.maven.org/artifact/org.owasp/dependency-check-maven/8.2.1/maven-plugin, which matches launchdarkly/java-server-sdk#308 (comment) and suggests that the plugin's docs are at https://jeremylong.github.io/DependencyCheck/dependency-check-maven/, which mentions the NISD NVD. I see no entry for CVE-2023-2976 at the NISD NVD (since the number is AFAIK still only "reserved"). I'm not sure where else OWASP is getting information from, since the NISD NVD data doesn't appear to even know that that number is associated with Guava. Notably, Sonatype's OSSIndex considers the issue to be resolved in that version: |
I would expect OSS Index to be the only one from that list that's relevant to Java. But maybe there are other sources, too. |
I'm able to add
I also looked at https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&orderBy=CPEURI&keyword=cpe%3A2.3%3Aa%3Agoogle%3Aguava%3A*%3A*%3A*%3A*%3A*%3A*%3A*%3A*&status=FINAL%2CDEPRECATED&startIndex=80 and didn't see any entries after 30.1 (which is the second release in which In contrast, if I downgrade to 29.0, I see an error:
I wonder if it would help for people to run the OWASP plugin's |
For me, the report says that sonatype thinks it's an issue. |
Thanks. It would be nice if https://ossindex.sonatype.org/component/pkg:maven/com.google.guava/guava let me see whether the data has changed over time. Are you in a position to try the |
FWIW, earlier today https://ossindex.sonatype.org/component/pkg:maven/com.google.guava/guava@32.0.0-jre most definitely showed a CVE in this release. Now it doesn't. So, if this is where the appropriate tool was getting data, then it should now be fixed, once caches are updated. For me, in any case, this is no longer firing. |
Excellent, thank you. |
It sounds like the issue cleared up when Sonatype fixed their data. If anyone still sees trouble, let us know. |
NVD changed their entry for https://nvd.nist.gov/vuln/detail/CVE-2023-2976 today to match up to excluding 32.0.1, i.e., as if 32.0.0 would still be affected. So CVE-2023-2976 is again being reported against 32.0.0. |
I just noticed this too. What the hell are they thinking? This is such a nuisance. Is there a way to contact them to fix this? |
:( Thanks for the reports. Does anyone know whether 32.0.0 is still reported as a problem? The NVD page show shows "Up to (excluding) 32.0.0," so perhaps this is fixed? |
This seems to be resolved in our reports now. Thanks for your responsivenesses!! |
despite rn it is still present following owasp report and other people #2575
The text was updated successfully, but these errors were encountered: