Protobuf used in PLCrashreporter has CVSS Vulnerability about plcrashreporter HOT 8 CLOSED

@ozzyremi It looks like protobuf is listed in the Git submodules for the project. So you want to do a "git submodule update --init" I think, to get the files checked out.

from plcrashreporter.

Hi @naveenkumart28, thank you for reporting this!
Protobuf is used by PLCR to persist the crash report in binary format, it is not used to send anything so it's unlikely to affect the libary.
But updating it is definitely a good idea. We have it in plans, but I can't provide any estimate yet.

from plcrashreporter.

microsoft/PLCrashReporter-Fork#19

from plcrashreporter.

Hi there. The fix has been merged into master

from plcrashreporter.

Hi @MatkovIvan,

How are we supposed to deal with protobuf binary? Are we supposed to download ourself and put into binary location because I am getting following error while building:
error: Build input file cannot be found: '/Users/username/Downloads/plcrashreporter-master 2/Dependencies/protobuf-c/protobuf-c/protobuf-c.c' (in target 'CrashReporter-MacOSX-Static' from project 'CrashReporter')

from plcrashreporter.

@danielpunkass Thank you. It worked!!

from plcrashreporter.

Hi @ozzyremi ,

As mentioned above it's a git submodule. This change is also described in readme and changelog

from plcrashreporter.

The fix is available in 1.4.0

from plcrashreporter.