compose-ui 1.3.0 imports protobuf-javalite:3.19.4 which triggers a security alert (CVE-2022-3171) [255545055]

Fixed

Bug

Status Update

No update yet.

Description

lo...@gmail.com

created issue #1

Oct 25, 2022 03:56PM

compose-ui triggers a security alert as it imports inspector.jar which contains protobuf-javalite:3.19.4. Please upgrade the version of protobuf-javalite to at least 3.19.6.

Jetpack Compose version: 1.3.0

Jetpack Compose component(s) used: compose-ui

Steps to Reproduce or Code Sample to Reproduce:

Add compose-ui to a project

Stack trace (if applicable):

ui-1.3.0.aar: inspector.jar/META-INF/maven/com.google.protobuf/protobuf-javalite/pom.xml (pkg:maven/com.google.protobuf/protobuf-javalite@3.19.4, cpe:2.3:a:google:protobuf-java:3.19.4:*:*:*:*:*:*:*, cpe:2.3:a:google:protobuf-javalite:3.19.4:*:*:*:*:*:*:*) : CVE-2022-3171

Comments

cl...@google.com <cl...@google.com> Oct 26, 2022 11:42AM

Assigned to ni...@google.com.

ni...@google.com <ni...@google.com> #2Oct 26, 2022 02:32PM

Thanks for trying out Room KMP! This looks like an issue with Android 9+ and armv7 and the way we compile sqlite3.c, specifically linking to the atomic library in C. We'll try to get this fix as soon as possible.

Message last modified on Oct 26, 2022 02:32PM

jl...@google.com <jl...@google.com> #3Oct 26, 2022 06:30PM

Very related: https://sqlite.org/forum/info/aa703e86823efca3, as suspected seems like a linking issue.

ni...@google.com <ni...@google.com> #4Oct 26, 2022 07:52PM

Facing the same issue here, surprisingly using the AndroidSQLiteDriver instead of the bundled one seems to work fine. So for now, others facing the crash can fix it by using the AndroidSQLiteDriver instead of the bundled one

ni...@google.com <ni...@google.com> #5Dec 15, 2022 08:57PM

Marked as fixed.

Project: platform/frameworks/support
Branch: androidx-main

commit cf121571aac008a756b64cda13f76ae4db3e85a6
Author: Daniel Santiago Rivera <danysantiago@google.com>
Date: Wed May 29 11:14:42 2024

Link to Android's atomic lib in bundled SQLite

Fix Bundled SQLite loading for devices with older ARM architecture by linking to Android's atomic library instead of relying on Clang's extension (c_atomic) or GCC's built-ins as used in sqlite3.c.

Also add support for passing linker args to androidx's native compilation infra.

See also discussion in

https://sqlite.org/forum/forumpost/792d76a592608d8f

Bug: 341639198
Test: Locally tested via BundledSQLiteDriverTest in a Nexus 5 on API 23
Change-Id: Ia818b7c4f1a990a1b5e35f4c7a3c89694aee0503

M buildSrc/private/src/main/kotlin/androidx/build/clang/ClangSharedLibraryTask.kt
M buildSrc/private/src/main/kotlin/androidx/build/clang/KonanBuildService.kt
M buildSrc/private/src/main/kotlin/androidx/build/clang/MultiTargetNativeCompilation.kt
M buildSrc/private/src/main/kotlin/androidx/build/clang/NativeTargetCompilation.kt
M sqlite/sqlite-bundled/build.gradle

https://android-review.googlesource.com/3108157

[Deleted User] <[Deleted User]> #6Dec 27, 2022 02:21PM

Hello, even if I updated to version androidx.sqlite:sqlite-bundled:2.5.0-alpha04 I just received a crash on a nexus 5X with android 8.1.0 and another one on Redmi Note 11 Pro with android 13.
I'm using androidx.room:room-runtime-android:2.7.0-alpha01.

This is the log:
Fatal Exception: java.lang.UnsatisfiedLinkError: dalvik.system.PathClassLoader[DexPathList[[zip file "/data/app/com.myproject-ssibkzVuLAo7tvV0puYoEg==/base.apk"],nativeLibraryDirectories=[/data/app/com.myproject-ssibkzVuLAo7tvV0puYoEg==/lib/x86, /system/lib, /vendor/lib]]] couldn't find "libsqliteJni.so"
at java.lang.Runtime.loadLibrary0(Runtime.java:1011)
at java.lang.System.loadLibrary(System.java:1657)
at androidx.sqlite.driver.bundled.NativeLibraryLoader.loadLibrary(NativeLibraryLoader.android.kt:1)
at androidx.sqlite.driver.bundled.BundledSQLiteDriver.<clinit>(BundledSQLiteDriver.jvmAndroid.kt:1)

Thank you!

Issue 255545055