Skip to content

Commit 58fca4e

Browse files
bestbeforetodaybestbeforetoday
authored
Update dependencies to address CVE-2024-7254 (#752)
This vulnerability affects the Java protobuf implementation. Signed-off-by: Mark S. Lewis <[email protected]>
1 parent 4dfc961 commit 58fca4e

File tree

5 files changed

+46
-36
lines changed

5 files changed

+46
-36
lines changed

‎go.mod‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,15 @@ module github.com/hyperledger/fabric-gateway
33
go 1.21.0
44

55
require (
6-
github.com/cucumber/godog v0.14.0
6+
github.com/cucumber/godog v0.14.1
77
github.com/hyperledger/fabric-protos-go-apiv2 v0.3.3
88
github.com/miekg/pkcs11 v1.1.1
99
github.com/spf13/pflag v1.0.5
1010
github.com/stretchr/testify v1.9.0
1111
go.uber.org/mock v0.4.0
12-
golang.org/x/crypto v0.22.0
13-
google.golang.org/grpc v1.63.2
14-
google.golang.org/protobuf v1.33.0
12+
golang.org/x/crypto v0.27.0
13+
google.golang.org/grpc v1.67.0
14+
google.golang.org/protobuf v1.34.2
1515
)
1616

1717
require (
@@ -23,9 +23,9 @@ require (
2323
github.com/hashicorp/go-memdb v1.3.4 // indirect
2424
github.com/hashicorp/golang-lru v1.0.2 // indirect
2525
github.com/pmezard/go-difflib v1.0.0 // indirect
26-
golang.org/x/net v0.24.0 // indirect
27-
golang.org/x/sys v0.19.0 // indirect
28-
golang.org/x/text v0.14.0 // indirect
29-
google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda // indirect
26+
golang.org/x/net v0.28.0 // indirect
27+
golang.org/x/sys v0.25.0 // indirect
28+
golang.org/x/text v0.18.0 // indirect
29+
google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142 // indirect
3030
gopkg.in/yaml.v3 v3.0.1 // indirect
3131
)

‎go.sum‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
22
github.com/cucumber/gherkin/go/v26 v26.2.0 h1:EgIjePLWiPeslwIWmNQ3XHcypPsWAHoMCz/YEBKP4GI=
33
github.com/cucumber/gherkin/go/v26 v26.2.0/go.mod h1:t2GAPnB8maCT4lkHL99BDCVNzCh1d7dBhCLt150Nr/0=
4-
github.com/cucumber/godog v0.14.0 h1:h/K4t7XBxsFBF+UJEahNqJ1/2VHVepRXCSq3WWWnehs=
5-
github.com/cucumber/godog v0.14.0/go.mod h1:FX3rzIDybWABU4kuIXLZ/qtqEe1Ac5RdXmqvACJOces=
4+
github.com/cucumber/godog v0.14.1 h1:HGZhcOyyfaKclHjJ+r/q93iaTJZLKYW6Tv3HkmUE6+M=
5+
github.com/cucumber/godog v0.14.1/go.mod h1:FX3rzIDybWABU4kuIXLZ/qtqEe1Ac5RdXmqvACJOces=
66
github.com/cucumber/messages/go/v21 v21.0.1 h1:wzA0LxwjlWQYZd32VTlAVDTkW6inOFmSM+RuOwHZiMI=
77
github.com/cucumber/messages/go/v21 v21.0.1/go.mod h1:zheH/2HS9JLVFukdrsPWoPdmUtmYQAQPLk7w5vWsk5s=
88
github.com/cucumber/messages/go/v22 v22.0.0/go.mod h1:aZipXTKc0JnjCsXrJnuZpWhtay93k7Rn3Dee7iyPJjs=
@@ -54,20 +54,20 @@ github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsT
5454
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
5555
go.uber.org/mock v0.4.0 h1:VcM4ZOtdbR4f6VXfiOpwpVJDL6lCReaZ6mw31wqh7KU=
5656
go.uber.org/mock v0.4.0/go.mod h1:a6FSlNadKUHUa9IP5Vyt1zh4fC7uAwxMutEAscFbkZc=
57-
golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
58-
golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
59-
golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
60-
golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
61-
golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
62-
golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
63-
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
64-
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
65-
google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda h1:LI5DOvAxUPMv/50agcLLoo+AdWc1irS9Rzz4vPuD1V4=
66-
google.golang.org/genproto/googleapis/rpc v0.0.0-20240401170217-c3f982113cda/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
67-
google.golang.org/grpc v1.63.2 h1:MUeiw1B2maTVZthpU5xvASfTh3LDbxHd6IJ6QQVU+xM=
68-
google.golang.org/grpc v1.63.2/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDomNkRA=
69-
google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
70-
google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
57+
golang.org/x/crypto v0.27.0 h1:GXm2NjJrPaiv/h1tb2UH8QfgC/hOf/+z0p6PT8o1w7A=
58+
golang.org/x/crypto v0.27.0/go.mod h1:1Xngt8kV6Dvbssa53Ziq6Eqn0HqbZi5Z6R0ZpwQzt70=
59+
golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE=
60+
golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
61+
golang.org/x/sys v0.25.0 h1:r+8e+loiHxRqhXVl6ML1nO3l1+oFoWbnlu2Ehimmi34=
62+
golang.org/x/sys v0.25.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
63+
golang.org/x/text v0.18.0 h1:XvMDiNzPAl0jr17s6W9lcaIhGUfUORdGCNsuLmPG224=
64+
golang.org/x/text v0.18.0/go.mod h1:BuEKDfySbSR4drPmRPG/7iBdf8hvFMuRexcpahXilzY=
65+
google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142 h1:e7S5W7MGGLaSu8j3YjdezkZ+m1/Nm0uRVRMEMGk26Xs=
66+
google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142/go.mod h1:UqMtugtsSgubUsoxbuAoiCXvqvErP7Gf0so0mK9tHxU=
67+
google.golang.org/grpc v1.67.0 h1:IdH9y6PF5MPSdAntIcpjQ+tXO41pcQsfZV2RxtQgVcw=
68+
google.golang.org/grpc v1.67.0/go.mod h1:1gLDyUQU7CTLJI90u3nXZ9ekeghjeM7pTDZlqFNg2AA=
69+
google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
70+
google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
7171
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
7272
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
7373
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

‎java/pom.xml‎

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22

33
<project xmlns="http://maven.apache.org/POM/4.0.0"
4-
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5-
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
66
<modelVersion>4.0.0</modelVersion>
77

88
<groupId>org.hyperledger.fabric</groupId>
@@ -38,7 +38,7 @@
3838
<properties>
3939
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
4040
<javaVersion>8</javaVersion>
41-
<bouncyCastleVersion>1.78</bouncyCastleVersion>
41+
<bouncyCastleVersion>1.78.1</bouncyCastleVersion>
4242
<skipUnitTests>${skipTests}</skipUnitTests>
4343
<pmdVersion>7.5.0</pmdVersion>
4444
</properties>
@@ -48,7 +48,7 @@
4848
<dependency>
4949
<groupId>io.cucumber</groupId>
5050
<artifactId>cucumber-bom</artifactId>
51-
<version>7.18.1</version>
51+
<version>7.19.0</version>
5252
<type>pom</type>
5353
<scope>import</scope>
5454
</dependency>
@@ -62,7 +62,15 @@
6262
<dependency>
6363
<groupId>io.grpc</groupId>
6464
<artifactId>grpc-bom</artifactId>
65-
<version>1.63.0</version>
65+
<version>1.66.0</version>
66+
<type>pom</type>
67+
<scope>import</scope>
68+
</dependency>
69+
<!-- Override transitive dependency from grpc-protobuf:1.66.0 to avoid CVE-2024-7254 -->
70+
<dependency>
71+
<groupId>com.google.protobuf</groupId>
72+
<artifactId>protobuf-bom</artifactId>
73+
<version>3.25.5</version>
6674
<type>pom</type>
6775
<scope>import</scope>
6876
</dependency>
@@ -133,7 +141,7 @@
133141
<dependency>
134142
<groupId>com.google.code.gson</groupId>
135143
<artifactId>gson</artifactId>
136-
<version>2.10.1</version>
144+
<version>2.11.0</version>
137145
</dependency>
138146
<dependency>
139147
<groupId>org.hyperledger.fabric</groupId>
@@ -198,7 +206,8 @@
198206
<showWarnings>true</showWarnings>
199207
<compilerArgs>
200208
<arg>-Xlint</arg>
201-
<arg>-Xlint:-options</arg> <!-- Disable command line warnings, seen when building against multiple releases: -->
209+
<arg>-Xlint:-options</arg> <!-- Disable command line warnings, seen when
210+
building against multiple releases: -->
202211
<arg>-Werror</arg>
203212
</compilerArgs>
204213
</configuration>
@@ -235,7 +244,8 @@
235244
<consoleOutputReporter>
236245
<disable>true</disable>
237246
</consoleOutputReporter>
238-
<statelessTestsetInfoReporter implementation="org.apache.maven.plugin.surefire.extensions.junit5.JUnit5StatelessTestsetInfoTreeReporter">
247+
<statelessTestsetInfoReporter
248+
implementation="org.apache.maven.plugin.surefire.extensions.junit5.JUnit5StatelessTestsetInfoTreeReporter">
239249
<theme>UNICODE</theme>
240250
<printStacktraceOnError>true</printStacktraceOnError>
241251
<printStacktraceOnFailure>true</printStacktraceOnFailure>

‎node/package.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,9 @@
3232
},
3333
"license": "Apache-2.0",
3434
"dependencies": {
35-
"@grpc/grpc-js": "^1.10.0",
35+
"@grpc/grpc-js": "^1.11.0",
3636
"@hyperledger/fabric-protos": "^0.3.0",
37-
"@noble/curves": "^1.4.0",
37+
"@noble/curves": "^1.6.0",
3838
"google-protobuf": "^3.21.0"
3939
},
4040
"optionalDependencies": {
@@ -57,6 +57,6 @@
5757
"ts-jest": "^29.2.4",
5858
"typedoc": "^0.26.6",
5959
"typescript": "~5.5.4",
60-
"typescript-eslint": "~8.5"
60+
"typescript-eslint": "~8.5.0"
6161
}
6262
}

‎scenario/node/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,6 @@
3535
"npm-run-all": "^4.1.5",
3636
"prettier": "^3.3.3",
3737
"typescript": "~5.5.4",
38-
"typescript-eslint": "^8.2.0"
38+
"typescript-eslint": "~8.5.0"
3939
}
4040
}

0 commit comments

Comments
 (0)