changes_2.8.3.md

Cloud Storage Extension 2.8.3, released 2024-09-26

Code name: Fixed vulnerability CVE-2024-7254 in com.google.protobuf:protobuf-java:jar:3.19.6:test

Summary

This release fixes the following vulnerability:

CVE-2024-7254 (CWE-20) in dependency com.google.protobuf:protobuf-java:jar:3.19.6:test

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i.e. StackOverflow. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

References

• https://ossindex.sonatype.org/vulnerability/CVE-2024-7254?component-type=maven&component-name=com.google.protobuf%2Fprotobuf-java&utm_source=ossindex-client&utm_medium=integration&utm_content=1.8.1
• http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7254
• https://github.com/advisories/GHSA-735f-pc8j-v9w8

Security

• #324: CVE-2024-7254: com.google.protobuf:protobuf-java:jar:3.25.4:compile

Dependency Updates

Cloud Storage Extension

Compile Dependency Updates

• Updated com.google.protobuf:protobuf-java:3.25.4 to 3.25.5

Test Dependency Updates

• Updated com.exasol:exasol-testcontainers:7.1.0 to 7.1.1
• Updated com.exasol:hamcrest-resultset-matcher:1.6.5 to 1.7.0
• Updated com.exasol:test-db-builder-java:3.5.4 to 3.6.0