diff options
| author | David Göransson <david.goransson@mullvad.net> | 2025-08-01 11:48:12 +0200 |
|---|---|---|
| committer | David Göransson <david.goransson@mullvad.net> | 2025-08-01 11:48:12 +0200 |
| commit | 5a8e054da09b27b541cf57722252feb63affdb96 (patch) | |
| tree | b17d13d98a9ab8a10a36ea63a9fefb2823020422 | |
| parent | a7392d75f9242e0e9853d85d829d3926caea9328 (diff) | |
| parent | 3439045ca8a683ae791eb84bebcb4f6cd200338e (diff) | |
| download | mullvadvpn-5a8e054da09b27b541cf57722252feb63affdb96.tar.xz mullvadvpn-5a8e054da09b27b541cf57722252feb63affdb96.zip | |
Merge branch 'update-osv-android-vulns'
| -rw-r--r-- | android/gradle/osv-scanner.toml | 33 |
1 files changed, 9 insertions, 24 deletions
diff --git a/android/gradle/osv-scanner.toml b/android/gradle/osv-scanner.toml index c45494e182..85d830b085 100644 --- a/android/gradle/osv-scanner.toml +++ b/android/gradle/osv-scanner.toml @@ -4,70 +4,55 @@ # protobuf-java: Has potential Denial of Service issue [[IgnoredVulns]] id = "CVE-2024-7254" # GHSA-735f-pc8j-v9w8 -ignoreUntil = 2025-08-01 +ignoreUntil = 2025-11-01 reason = "Should not be applicable since client and server are always in sync and we are only communicating locally over UDS." -# apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader -[[IgnoredVulns]] -id = "CVE-2024-47554" # GHSA-78wr-2p64-hpwj -ignoreUntil = 2025-08-01 -reason = "No impact since the app doesn't process externally crafted XML." - # netty: HttpPostRequestDecoder can OOM [[IgnoredVulns]] id = "CVE-2024-29025" # GHSA-5jpm-x58v-624v -ignoreUntil = 2025-08-01 +ignoreUntil = 2025-11-01 reason = "We do not use netty for http communication." # netty: Vulnerable to HTTP/2 Rapid Reset Attack [[IgnoredVulns]] id = "CVE-2023-44487" # GHSA-xpw8-rcwv-8f8p -ignoreUntil = 2025-08-01 +ignoreUntil = 2025-11-01 reason = "No impact on this app since it uses UDS rather than HTTP2." # Same as the vuln above, but it seems like osv scanner does not always make the connection. [[IgnoredVulns]] id = "GHSA-xpw8-rcwv-8f8p" -ignoreUntil = 2025-08-01 +ignoreUntil = 2025-11-01 reason = "No impact on this app since it uses UDS rather than HTTP2." # netty: SniHandler 16MB allocation [[IgnoredVulns]] id = "CVE-2023-34462" # GHSA-6mjq-h674-j845 -ignoreUntil = 2025-08-01 +ignoreUntil = 2025-11-01 reason = "We do not use netty for http communication." # apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file [[IgnoredVulns]] id = "CVE-2024-26308" # GHSA-4265-ccf5-phj5 -ignoreUntil = 2025-08-01 +ignoreUntil = 2025-11-01 reason = "Apache commons compress is used by lint and not the app directly." # apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file [[IgnoredVulns]] id = "CVE-2024-25710" # GHSA-4g9r-vxhx-9pgx -ignoreUntil = 2025-08-01 +ignoreUntil = 2025-11-01 reason = "Apache commons compress is used by lint and not the app directly." # apache httpclient: Cross-site scripting [[IgnoredVulns]] id = "CVE-2020-13956" # GHSA-7r82-7xv7-xcpj -ignoreUntil = 2025-08-01 +ignoreUntil = 2025-11-01 reason = "Apache http client is used by lint and not the app directly." -# Several vulns related to bouncy castle that is only being used by lint. -# These are not used directly in the app. -[[PackageOverrides]] -name = "org.bouncycastle:bcprov-jdk18on" -ecosystem = "Maven" -ignore = true -effectiveUntil = 2025-08-01 -reason = "Used by lint and not the app directly." - # kotlin: Improper Locking [[IgnoredVulns]] id = "CVE-2022-24329" # GHSA-2qp4-g3q3-f92w -ignoreUntil = 2025-08-01 +ignoreUntil = 2025-11-01 reason = "This CVE only affect Multiplatform Gradle Projects, which this project is not." # netty: Denial of Service attack on windows app |