-
-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Bug]: Upgrade to Guava 32+ to fix CVE-2023-2976 #7525
Labels
Comments
Hi @ppalaga, that guava version is used by japicmp plugin for gradle configuration purposes. The shaded guava library is coming from https://github.com/docker-java/docker-java which is not being used anymore. |
#7534 should fix it but will take a look in more detail once I'm back from vacation. |
you can also exclude it and it should be fine |
eddumelendez
added a commit
that referenced
this issue
Sep 26, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Module
Core
Testcontainers version
1.19.0
Using the latest Testcontainers version?
Yes
Host OS
any
Host Arch
any
Docker version
What happened?
I hope my understanding is correct that the shaded
org/testcontainers/shaded/com/google/common/io/FileBackedOutputStream.class
file inorg.testcontainers:testcontainers:1.19.0
comes from guava 30.1.1-jre:https://github.com/testcontainers/testcontainers-java/blob/1.19.0/build.gradle#L8
Guava versions >= 1.0, < 32.0.0 suffer from CVE-2023-2976 alias google/guava#2575
It would be nice to upgrade the shaded Guava and release
Relevant log output
No response
Additional Information
No response
The text was updated successfully, but these errors were encountered: