gradle/libs.versions.toml on main pins:
protobufJavalite = "3.22.0"
3.22.0 is affected by GHSA-735f-pc8j-v9w8 / CVE-2024-7254, fixed in 3.25.5. The parser recurses without bound on deeply nested groups and unknown fields, which throws StackOverflowError. CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, availability only.
The runtime pin is still 3.22.0. #686 bumped the protobuf Gradle plugin in the root build.gradle, not the library.
Two reasons this seems worth bumping:
-
It is reachable from network input. RTCEngine.onMessage calls LivekitModels.DataPacket.parseFrom straight on the data channel bytes, so a remote participant controls what the parser sees.
-
It propagates. The published POM for io.livekit:livekit-android:2.28.0 declares protobuf-javalite 3.22.0 at runtime scope, so it lands on the runtime classpath of every app that depends on the SDK and gets flagged by their dependency scanners.
Side note: .github/dependabot.yml declares a weekly gradle ecosystem update, but I cannot find any Dependabot PRs on the repo, so it may be disabled at the org level. That would explain the pin going unnoticed.
#1002 bumps protobufJavalite to 3.25.9, the latest on that line. It moves the runtime pin only, leaving protobuf at 3.22.0 since that one selects protoc and the protobuf-java jar the build unzips descriptor.proto out of, neither of which reaches a consumer classpath.
gradle/libs.versions.tomlon main pins:3.22.0 is affected by GHSA-735f-pc8j-v9w8 / CVE-2024-7254, fixed in 3.25.5. The parser recurses without bound on deeply nested groups and unknown fields, which throws
StackOverflowError. CVSS 3.1AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, availability only.The runtime pin is still 3.22.0. #686 bumped the protobuf Gradle plugin in the root
build.gradle, not the library.Two reasons this seems worth bumping:
It is reachable from network input.
RTCEngine.onMessagecallsLivekitModels.DataPacket.parseFromstraight on the data channel bytes, so a remote participant controls what the parser sees.It propagates. The published POM for
io.livekit:livekit-android:2.28.0declares protobuf-javalite 3.22.0 at runtime scope, so it lands on the runtime classpath of every app that depends on the SDK and gets flagged by their dependency scanners.Side note:
.github/dependabot.ymldeclares a weeklygradleecosystem update, but I cannot find any Dependabot PRs on the repo, so it may be disabled at the org level. That would explain the pin going unnoticed.#1002 bumps
protobufJavaliteto 3.25.9, the latest on that line. It moves the runtime pin only, leavingprotobufat 3.22.0 since that one selects protoc and theprotobuf-javajar the build unzipsdescriptor.protoout of, neither of which reaches a consumer classpath.