Dependency to com.squareup.wire:wire-runtime:2.2.0 with CVEs #1128

Activity

1. dmikusa commented on Jan 18, 2022

   

   dmikusa

   on Jan 18, 2022

   More actions

   We'll get this and a few other versions bumped shortly.

   For what it's worth, our releases do not bundle these dependencies in them. It's just referenced. You should be able to override the version in your own pom.xml.

   For example:

                   <dependency>
   			<groupId>com.squareup.wire</groupId>
   			<artifactId>wire-runtime</artifactId>
   			<version>4.0.1</version>
   		</dependency>
   

   Let me know if you're hitting problems with that. Thanks
2. dmikusa

   added

   dependenciesPull requests that update a dependency filePull requests that update a dependency file

   triagedInitial triage of issue has been performedInitial triage of issue has been performed

   on Jan 18, 2022
3. donacarr commented on Jun 8, 2022

   

   donacarr

   on Jun 8, 2022

   More actions

   Just to let you know that latest dep scan found 9 CRITICAL CVEs:

   https://nvd.nist.gov/vuln/detail/CVE-2018-8909
   https://nvd.nist.gov/vuln/detail/CVE-2020-15258
   https://nvd.nist.gov/vuln/detail/CVE-2021-21301
   https://nvd.nist.gov/vuln/detail/CVE-2020-27853
   https://nvd.nist.gov/vuln/detail/CVE-2021-32665
   https://nvd.nist.gov/vuln/detail/CVE-2021-32666
   https://nvd.nist.gov/vuln/detail/CVE-2021-32755
   https://nvd.nist.gov/vuln/detail/CVE-2021-41093
   https://nvd.nist.gov/vuln/detail/CVE-2022-23625
4. dmikusa commented on Jun 8, 2022

   

   dmikusa

   on Jun 8, 2022

   Last edited by dmikusa

   More actions

   https://nvd.nist.gov/vuln/detail/CVE-2018-8909
   https://nvd.nist.gov/vuln/detail/CVE-2020-15258
   https://nvd.nist.gov/vuln/detail/CVE-2021-21301
   https://nvd.nist.gov/vuln/detail/CVE-2020-27853
   https://nvd.nist.gov/vuln/detail/CVE-2021-32665
   https://nvd.nist.gov/vuln/detail/CVE-2021-32666
   https://nvd.nist.gov/vuln/detail/CVE-2021-32755
   https://nvd.nist.gov/vuln/detail/CVE-2021-41093
   https://nvd.nist.gov/vuln/detail/CVE-2022-23625

   @donacarr I don't believe any of these are actually problems with the wire we consume. They all reference "wireos" and seem to be issues with some unrelated mobile (IOS/Android) library.

   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15250
   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10237

   I'm not even sure that the original three issues reported impact cf-java-client. The notes on those issues reference Guava and JUnit. Junit is the only item we actually consume, obviously that only happens during testing.

   We did look into upgrading but the problem is that the com.squareup.wire Maven plugin that we're using was discontinued so it's not just a matter of bumping the version. It'll take more effort to evaluate if a switch is possible and to do regression testing to make sure that switching doesn't cause any breaking changes.
5. kvmw commented on Jun 30, 2025

   

   kvmw

   on Jun 30, 2025

   Contributor

   More actions

   @Kehrlann Is there any plan to upgrade the wire-runtime in the coming releases? It would be nice to have it upgraded to 4.x or 5.x, to mitigate CVE-2023-3635
6. Kehrlann commented on Jun 30, 2025

   

   Kehrlann

   on Jun 30, 2025

   Contributor

   More actions

   @kvmw unfortunately, I can't get Wire to work with JDK 8, see #1262 (comment)

   We'll release a new major version with JDK 17 support, and Wire 5.x

   👍React with 👍1Reacted by Kaveh Shamsi