New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

False report for CVE-2023-33953? #10553

Closed

nicolaideffremo opened this issue Sep 12, 2023 · 1 comment

Labels

nicolaideffremo commented Sep 12, 2023

Hi all,

Our dependency check reports CVE-2023-33953 for grpc-java.

The google cloud vulnerability report does not mention the java library, only the C++ implementation. So we think this is a false positive.

Do you use the C++ implementation internally anywhere? Otherwise we can exclude it as a false positive.

nicolaideffremo added the question label

Member

ejona86 commented Sep 12, 2023

Yeah, that was only for the C++ implementation. It doesn't impact Java, Go, and .Net.

ejona86 closed this as completed

github-actions bot locked as resolved and limited conversation to collaborators

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.