launchdarkly/java-server-sdk

Synk reports the low version of okHttp3 dependency

MiaousX opened this issue · 3 comments

MiaousX commented

Problem
When I run my project through pipeline, synk alert me that launchdarkly use the low version of okhttp3 which may have some information exposure risks.

Desired Solution
In my project, I used gradle to exclude the okhttp3 in launchdarkly and implement latest version by myself. Would you like to consider updating the version in your repo?

Additional context
I used launchdarkly version 5.9.0, and I haven't do much research on latest version (if you already updated it, please ignore). Thanks.

eli-darkly commented

Thanks. Ironically, I think I was the first to report this problem, but after they released a patch for it, we had not updated to that patch because we had already implemented a workaround to prevent any such values from being logged. So we don't think it is an actual risk at this point, but we still should update the dependency version, especially now that there is a CVE for this issue.

eli-darkly commented

This is fixed in the 5.9.3 release.