compose-ui 1.3.0 imports protobuf-javalite:3.19.4 which triggers a security alert (CVE-2022-3171) [255545055]

Fixed

Bug

Status Update

No update yet.

Description

lo...@gmail.com

created issue #1

Oct 25, 2022 03:56PM

compose-ui triggers a security alert as it imports inspector.jar which contains protobuf-javalite:3.19.4. Please upgrade the version of protobuf-javalite to at least 3.19.6.

Jetpack Compose version: 1.3.0

Jetpack Compose component(s) used: compose-ui

Steps to Reproduce or Code Sample to Reproduce:

Add compose-ui to a project

Stack trace (if applicable):

ui-1.3.0.aar: inspector.jar/META-INF/maven/com.google.protobuf/protobuf-javalite/pom.xml (pkg:maven/com.google.protobuf/protobuf-javalite@3.19.4, cpe:2.3:a:google:protobuf-java:3.19.4:*:*:*:*:*:*:*, cpe:2.3:a:google:protobuf-javalite:3.19.4:*:*:*:*:*:*:*) : CVE-2022-3171

Comments

cl...@google.com <cl...@google.com> Oct 26, 2022 11:42AM

Assigned to ni...@google.com.

ni...@google.com <ni...@google.com> #2Oct 26, 2022 02:32PM

Any update on this issue? We are seeing same crashes on lower end devices. Is there any temporary fix we could use?

Message last modified on Oct 26, 2022 02:32PM

jl...@google.com <jl...@google.com> #3Oct 26, 2022 06:30PM

ni...@google.com <ni...@google.com> #4Oct 26, 2022 07:52PM

deleted

ni...@google.com <ni...@google.com> #5Dec 15, 2022 08:57PM

Marked as fixed.

In our case, we have b2b app running on dedicated devices.

After 1.1.0 DataStore update we had 6 terminals reported 30k androidx.datastore.core.CorruptionException fatal crashes on app start.

We use DataStore in WorkManager jobs and on regular Activity starts. Seems that after the application gets this state it will never will succeed to start successfully again. I am afraid that data is being corrupted.

Can't reproduce. But same as OP, we have very vanilla usage of DataStore Preferences. No multiple processes, just simple read/write key-values in a single process single Activity.

[Deleted User] <[Deleted User]> #6Dec 27, 2022 02:21PM

Hi, thanks for the feedback, noticed the number of +1s, I'll prioritize an investigation.

To facilitate the process, could you please share how you create the DataStore instance?

Issue 255545055