Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade Scrimage to latest version #339

Open
inktomi opened this issue May 10, 2023 · 0 comments
Open

Upgrade Scrimage to latest version #339

inktomi opened this issue May 10, 2023 · 0 comments

Comments

@inktomi
Copy link

inktomi commented May 10, 2023

Expected behaviour

Shot is usable without pulling in transitive dependencies that have CVE issues against them.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24614
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24613
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29425

Actual behaviour

Shot uses a very old version of Scrimage which in turn uses an older version of imageio-jpeg, which itself is vulnerable and causing this issue.

Fixing this should be a simple dependency update - though note that around version 3.0.0 the module name changed. The new dependency should be something like "com.sksamuel.scrimage:scrimage-core:4.0.34"

https://github.com/sksamuel/scrimage/releases

From what I can tell, these versions should be binary compatible with the one currently in use - I don't see any breaking changes listed in the release notes.

Steps to reproduce

Check dependency chain. Shot-core is currently using "com.sksamuel.scrimage:scrimage-core_2.12:2.1.8"

https://github.com/pedrovgs/Shot/blob/master/core/build.gradle#LL16C22-L16C67

Version of the library

5.14.1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant