Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.github.ascopes:protobuf-maven-plugin

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 1.0MavenPublished

    Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH

    GHSA-j2pc-v64r-mv4f

    Affected
    • Maven io.github.ascopes:protobuf-maven-plugin >= 4.0.0, <= 4.0.1; < 3.10.2
    Fixed in
    3.10.24.0.2· Vendor fix available
    Issue
    The expected protocDigest is ignored when protoc is taken from the PATH. Details The documentation for the protocDigest parameter says: ... Users may wish to specify this if using a PATH-based binary ... However, when specifying <protocPATH</protoc the protocDigest is not actually checked because the code returns here already https://github.com/ascopes/protobuf-maven-plugin/blob/59097aae8062c461129a13dcda2f4116b90a8765/protobuf-maven-plugin/src/main/java/io/github/ascopes/protobufmavenplugin/protoc/ProtocResolver.java#L91-L93 before the digest check: https://github.com/ascopes/protobuf-maven-plugin/blob/59097aae8062c461129a13dcda2f4116b90a8765/protobuf-maven-plugin/src/main/java/io/github/ascopes/protobufmavenplugin/protoc/ProtocResolver.java#L106 PoC Specify: And notice how the protoc on the PATH is not rejected, despite a digest mismatch. Impact Users who have an untrusted protoc executable on their PATH and rely <protocDigest as protection are affected.

    Recommended action: Upgrade to 4.0.2 or 3.10.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →