Skip to content

Conversation

@pjfanning
Copy link
Member

protobuf-java 3.25.6 has a breaking change where it fails at runtime (deliberately) if makeExtensionsImmutable method is called as part of generated protobuf code. This presumably is due to security concerns.

@pjfanning
Copy link
Member Author

looks like hbase is one of biggest issues - hbase has old generated protobuf code

  Caused By (java.lang.UnsupportedOperationException) As of 2022/09/29 (release 21.7) makeExtensionsImmutable should not be called from protobuf gencode. If you are seeing this message, your gencode is vulnerable to a denial of service attack. You should regenerate your code using protobuf 25.6 or later. Use the latest version that meets your needs. However, if you understand the risks and wish to continue with vulnerable gencode, you can set the system property `-Dcom.google.protobuf.use_unsafe_pre22_gencode` on the command line. See security vulnerability: https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2
    com.google.protobuf.GeneratedMessage.warnPre22Gencode():327
    com.google.protobuf.GeneratedMessage.makeExtensionsImmutable():333
    org.apache.hadoop.hbase.protobuf.generated.FilterProtos$Filter.<init>():109
    org.apache.hadoop.hbase.protobuf.generated.FilterProtos$Filter.<init>():42
    org.apache.hadoop.hbase.protobuf.generated.FilterProtos$Filter$1.parsePartialFrom():130
    org.apache.hadoop.hbase.protobuf.generated.FilterProtos$Filter$1.parsePartialFrom():125
    com.google.protobuf.AbstractParser.parsePartialFrom():135
    com.google.protobuf.AbstractParser.parseFrom():168
    com.google.protobuf.AbstractParser.parseFrom():180
    com.google.protobuf.AbstractParser.parseFrom():185
    com.google.protobuf.AbstractParser.parseFrom():25
    org.apache.hadoop.hbase.protobuf.generated.FilterProtos$Filter.parseFrom():314

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant