CVE-2024-7254 potential Denial of Service issue in protobuf-java

[robert-gdv]

Sonatype reports CVE-2024-7254 on io.prometheus : prometheus-metrics-shaded-protobuf with a CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Score of 8.7.

It is reported, that all Versions of prometheus-metrics-shaded-protobuf until 1.3.1 included are affected. There is currently no unaffected Version of prometheus-metrics-shaded-protobuf available while the unshaded library protobuf-java was already fixed.

See also https://github.com/advisories/GHSA-735f-pc8j-v9w8

[ghost]

Apparently fixed in https://github.com/prometheus/client_java/pull/1008 I am waiting for a release.

[ghost]

On the other hand: That was an automated update. I am not sure that dependabot understands the shading. Shouldn't it update also the protobuf.version.string variable?

[zeitlinger]

I've created https://github.com/prometheus/client_java/pull/1063 to address this

[artemptushkin]

@zeitlinger which version of prometheus-metrics-shaded-protobuf contains or will the fix?

[zeitlinger]

1.3.2

[ghost]

Thx!