This library has a dependency on google-http-client (version 1.42.3) which ultimately depends on a version of grpc-context (1.27.2) which is vulnerable to several CVEs.
The exact dependency chain is as follows:
[INFO] +- com.google.api-client:google-api-client:jar:2.2.0:compile
[INFO] | +- commons-codec:commons-codec:jar:1.15:compile
[INFO] | +- com.google.oauth-client:google-oauth-client:jar:1.34.1:compile
[INFO] | +- com.google.http-client:google-http-client-gson:jar:1.42.3:compile
[INFO] | | \- com.google.code.gson:gson:jar:2.10:compile
[INFO] | +- com.google.http-client:google-http-client-apache-v2:jar:1.42.3:compile
[INFO] | +- org.apache.httpcomponents:httpcore:jar:4.4.16:compile
[INFO] | +- org.apache.httpcomponents:httpclient:jar:4.5.14:compile
[INFO] | | \- commons-logging:commons-logging:jar:1.2:compile
[INFO] | \- com.google.http-client:google-http-client:jar:1.42.3:compile
[INFO] | +- io.opencensus:opencensus-api:jar:0.31.1:compile
[INFO] | | \- io.grpc:grpc-context:jar:1.27.2:compile
[INFO] | \- io.opencensus:opencensus-contrib-http-util:jar:0.31.1:compile
The vulnerable library is ultimately included through opensensus, but that repository has been archived on Github, and the code is since unmaintained. The vulnerable version of grpc is defined here.
Would it be possible to remove the ultimate dependency on this grpc package, or potentially remove the unmaintained code as dependencies altogether?
Also flagged in googleapis/google-http-java-client#1915
This library has a dependency on
google-http-client(version1.42.3) which ultimately depends on a version ofgrpc-context(1.27.2) which is vulnerable to several CVEs.The exact dependency chain is as follows:
The vulnerable library is ultimately included through opensensus, but that repository has been archived on Github, and the code is since unmaintained. The vulnerable version of grpc is defined here.
Would it be possible to remove the ultimate dependency on this grpc package, or potentially remove the unmaintained code as dependencies altogether?
Also flagged in googleapis/google-http-java-client#1915