Vertx-web: CVE reported for guava 20.0

[encodeering]

Questions

OWASP dependency check plugin reports the following CVE for guava

Version

3.8.3

Context

Security check of all used dependencies revealed this. An update to a newer version might be good.

Do you have a reproducer?

OWASP provides a cli tool as well as some integrations for maven and gradle builds

Steps to reproduce

Extra

[pmlopes]

Guava is used by one of the template engines the core modules (web, web-common, web-client) don't.

But indeed we need to address it.

[encodeering]

Hi @pmlopes, thanks for the fast reply.

We are using vertx-web-api-contract only as openapi implementation without the templating. It seems that swagger parser v3 in version 2.0.14 doesn't depend on guava anymore, so the exclude and the pinning could be removed from the contract.

It may of course have implications if other project use that dependency without an explicit definition.

Is there any other reason why guava has been pinned in that project?

[pmlopes]

The reason was because guava is used in several dependencies across many vert.x modules and there have been reports that users in some cases end up with several versions on the classpath which is problematic. We tried to keep them aligned, like we also do for netty as these projects often have problems running with different versions on the classpath. Perhaps we need to do another ful stack analysis and clean this up.

[slinkydeveloper]

@encodeering If it's not a transitive dependency anymore of swagger-parser, can you raise a pr for it? thank you!

[pmlopes]

We've upgraded guava across the stack, this issue isn't applicable anymore