google/protobuf has an advisory https://github.com/advisories/GHSA-p2gh-cfq4-4wjc

This moves to `^4.33.6`, which has the fix.

CommentFileSizeAuthor
opentelemetry-google-protobuf-4.patch443 bytesrobloach

Issue fork opentelemetry-3581743

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

robloach created an issue. See original summary.

robloach’s picture

robloach
he/him
commented
Title: Protobuf: Denial of Service through malicious messages containing negative varints or deep recursion » Update to google/protobuf 4.x

robloach opened merge request !77

abhisekmazumdar’s picture

abhisekmazumdar
he/him
Primary language English
Location India
commented
Status: Needs review » Reviewed & tested by the community

Over the Drupal AI module, we dev required opentelemetry, and this was flagged in the pipelines. Thank you @robloach for reporting and creating the fix.

These changes look good to me. So, I marked this RTBC with my limited knowledge of opentelemetry. If the maintainer thinks this might cause some breaking changes, please feel free to move it back. I look forward to this getting merged soon.

murz’s picture

murz
Primary language English
Location Yerevan, Armenia
commented
Status: Reviewed & tested by the community » Fixed

Looks good to me, tested a bit, and seems updating the google/protobuf from 3.x to 4.x does not require any changes from the module side, so merged this.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • murz committed 5f7d210f on 1.x authored by robloach 
    fix: #3581743 Update to google/protobuf 4.x

By: robloach
By:...
g.rocchini’s picture

g.rocchini commented

Hello Murz,
can you tag the module with this merge, so that
composer require 'drupal/opentelemetry:^1.0@beta'
will make this available?
thanks

murz’s picture

murz
Primary language English
Location Yerevan, Armenia
commented
Status: Fixed » Closed (fixed)

There are more issues merged into the branch, so it took time to review all the changes that will be included in the new release. Released now 1.0.0-beta7 that includes this fix too.

g.rocchini’s picture

g.rocchini commented

Thanks Murz!