other(cve): Fix CVE-2024-7254 (#3408) (#3412)

(cherry picked from commit 351c15c) Co-authored-by: Jonathan <[email protected]>
camunda · Oct 1, 2024 · 26e0d1f · 26e0d1f
1 parent cb6667b
commit 26e0d1f
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 7 deletions.
diff --git a/.gitignore b/.gitignore
@@ -1,3 +1,6 @@
+# Snyk cache
+.dccache
+
 # Compiled class file
 *.class
 

diff --git a/bundle/camunda-saas-bundle/pom.xml b/bundle/camunda-saas-bundle/pom.xml
@@ -28,13 +28,6 @@
       <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
     </dependency>
 
-    <!-- Fix CVE-2024-7254 -->
-    <dependency>
-      <groupId>com.google.protobuf</groupId>
-      <artifactId>protobuf-java-util</artifactId>
-      <version>3.25.5</version>
-    </dependency>
-
     <dependency>
       <groupId>io.camunda.connector</groupId>
       <artifactId>connector-gcp-secret-provider</artifactId>

diff --git a/connectors/pom.xml b/connectors/pom.xml
@@ -41,6 +41,12 @@ except in compliance with the proprietary license.</license.inlineheader>
   </properties>
 
   <dependencies>
+    <!-- Fix CVE-2024-7254 -->
+    <dependency>
+      <groupId>com.google.protobuf</groupId>
+      <artifactId>protobuf-java-util</artifactId>
+      <version>3.25.5</version>
+    </dependency>
     <dependency>
       <groupId>io.camunda.connector</groupId>
       <artifactId>connector-validation</artifactId>

diff --git a/parent/pom.xml b/parent/pom.xml
@@ -480,6 +480,12 @@ limitations under the License.</license.inlineheader>
         <artifactId>protobuf-java</artifactId>
         <version>3.25.5</version>
       </dependency>
+      <!-- Fix CVE-2024-7254 -->
+      <dependency>
+        <groupId>com.google.protobuf</groupId>
+        <artifactId>protobuf-java-util</artifactId>
+        <version>3.25.5</version>
+      </dependency>
 
       <dependency>
         <groupId>org.bouncycastle</groupId>