pfadi-nunenen/nuenenen_app

X-Platform App für die Pfadi Nünenen

nuenenen_app's Issues

CVE-2021-21401 (High) detected in nanopb/decode-1.30906.0, nanopb-1.30906.0

CVE-2021-21401 - High Severity Vulnerability

Vulnerable Libraries - nanopb/decode-1.30906.0, nanopb-1.30906.0

nanopb/decode-1.30906.0

Nanopb is a small code-size Protocol Buffers implementation in ansi C. It is especially suitable for use in microcontrollers, but fits any memory restricted system.

Library home page: https://github.com/nanopb/nanopb/archive/0.3.9.6.zip

Path to dependency file: nuenenen/ios/Podfile.lock

Path to vulnerable library: nuenenen/ios/Podfile.lock

Dependency Hierarchy:

• firebase_core-0.5.3 (Root Library)
  • Firebase/CoreOnly-6.33.0
    • FirebaseCore-6.10.3
      • FirebaseCoreDiagnostics-1.7.0
        • GoogleDataTransport-7.5.1
          • nanopb-1.30906.0
            • ❌ nanopb/decode-1.30906.0 (Vulnerable Library)

nanopb-1.30906.0

Nanopb is a small code-size Protocol Buffers implementation in ansi C. It is especially suitable for use in microcontrollers, but fits any memory restricted system.

Library home page: https://github.com/nanopb/nanopb/archive/0.3.9.6.zip

Path to dependency file: nuenenen/ios/Podfile.lock

Path to vulnerable library: nuenenen/ios/Podfile.lock

Dependency Hierarchy:

• firebase_core-0.5.3 (Root Library)
  • Firebase/CoreOnly-6.33.0
    • FirebaseCore-6.10.3
      • FirebaseCoreDiagnostics-1.7.0
        • GoogleDataTransport-7.5.1
          • ❌ nanopb-1.30906.0 (Vulnerable Library)

Found in HEAD commit: b3b668f4977d27ec208c2f2043c38c4c9ad83eb0

Found in base branch: master

Vulnerability Details

Nanopb is a small code-size Protocol Buffers implementation in ansi C. In Nanopb before versions 0.3.9.8 and 0.4.5, decoding a specifically formed message can cause invalid free() or realloc() calls if the message type contains an oneof field, and the oneof directly contains both a pointer field and a non-pointer field. If the message data first contains the non-pointer field and then the pointer field, the data of the non-pointer field is incorrectly treated as if it was a pointer value. Such message data rarely occurs in normal messages, but it is a concern when untrusted data is parsed. This has been fixed in versions 0.3.9.8 and 0.4.5. See referenced GitHub Security Advisory for more information including workarounds.

Publish Date: 2021-03-23

URL: CVE-2021-21401

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7mv5-5mxh-qg88

Release Date: 2021-03-23

Fix Resolution: nanopb - 0.3.9.8,0.4.5

---

Step up your Open Source Security Game with WhiteSource here

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update dependency com.google.gms:google-services to v4.4.0
• Update dependency gradle to v8.5
• Update kotlin monorepo to v1.9.21 (org.jetbrains.kotlin:kotlin-stdlib-jdk7, org.jetbrains.kotlin:kotlin-gradle-plugin)
• Update dependency com.android.tools.build:gradle to v8
• Update dependency dart to v3
• Update dependency flutter_lints to v3
• Update dependency http to v1
• Update dependency permission_handler to v11
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

gradle

android/gradle.properties

android/settings.gradle

android/build.gradle

• com.android.tools.build:gradle 7.4.2
• com.google.gms:google-services 4.3.15
• org.jetbrains.kotlin:kotlin-gradle-plugin 1.6.21
• org.jetbrains.kotlin:kotlin-stdlib-jdk7 1.6.21

android/app/build.gradle

gradle-wrapper

android/gradle/wrapper/gradle-wrapper.properties

• gradle 8.2.1

pub

pubspec.yaml

• flutter
• cupertino_icons ^1.0.5
• fluro ^2.0.5
• http ^0.13.5
• fluttertoast ^8.2.1
• shared_preferences ^2.1.0
• permission_handler ^10.2.0
• flutter_html ^2.2.1
• url_launcher ^6.1.10
• firebase_messaging ^14.4.1
• firebase_core ^2.10.0
• flutter_lints ^2.0.1
• dart >=2.18.5 <3.0.0

---

• Check this box to trigger a request for Renovate to run again on this repository

CVE-2020-26243 (High) detected in nanopb/decode-1.30906.0, nanopb-1.30906.0

CVE-2020-26243 - High Severity Vulnerability

Vulnerable Libraries - nanopb/decode-1.30906.0, nanopb-1.30906.0

nanopb/decode-1.30906.0

Nanopb is a small code-size Protocol Buffers implementation in ansi C. It is especially suitable for use in microcontrollers, but fits any memory restricted system.

Library home page: https://github.com/nanopb/nanopb/archive/0.3.9.6.zip

Path to dependency file: nuenenen/ios/Podfile.lock

Path to vulnerable library: nuenenen/ios/Podfile.lock

Dependency Hierarchy:

• firebase_core-0.5.3 (Root Library)
  • Firebase/CoreOnly-6.33.0
    • FirebaseCore-6.10.3
      • FirebaseCoreDiagnostics-1.7.0
        • GoogleDataTransport-7.5.1
          • nanopb-1.30906.0
            • ❌ nanopb/decode-1.30906.0 (Vulnerable Library)

nanopb-1.30906.0

Nanopb is a small code-size Protocol Buffers implementation in ansi C. It is especially suitable for use in microcontrollers, but fits any memory restricted system.

Library home page: https://github.com/nanopb/nanopb/archive/0.3.9.6.zip

Path to dependency file: nuenenen/ios/Podfile.lock

Path to vulnerable library: nuenenen/ios/Podfile.lock

Dependency Hierarchy:

• firebase_core-0.5.3 (Root Library)
  • Firebase/CoreOnly-6.33.0
    • FirebaseCore-6.10.3
      • FirebaseCoreDiagnostics-1.7.0
        • GoogleDataTransport-7.5.1
          • ❌ nanopb-1.30906.0 (Vulnerable Library)

Found in HEAD commit: b0801665d41e6af796a99b0f7b9ada6166fb1f3d

Found in base branch: master

Vulnerability Details

Nanopb is a small code-size Protocol Buffers implementation. In Nanopb before versions 0.4.4 and 0.3.9.7, decoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed. This is fixed in versions 0.3.9.7 and 0.4.4. The following workarounds are available: 1) Set the option no_unions for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code. 2) Set the type of the submessage field inside oneof to FT_POINTER. This way the whole submessage will be dynamically allocated and the problematic code is not executed. 3) Use an arena allocator for nanopb, to make sure all memory can be released afterwards.

Publish Date: 2020-11-25

URL: CVE-2020-26243

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1902065

Release Date: 2020-11-25

Fix Resolution: nanopb-0.3.9.7,nanopb-0.4.4

---

Step up your Open Source Security Game with WhiteSource here

Action Required: Fix Renovate Configuration

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.

File: renovate.json
Error type: Invalid JSON (parsing failed)
Message: Syntax error near ", ],