[High] Snyk: Integer Overflow (due 5/17/19)

[fecjjeng]

Integer Overflow
Vulnerable module: com.google.protobuf:protobuf-java
Introduced through: org.flywaydb:[email protected]
Detailed paths
Introduced through: [email protected] › org.flywaydb:[email protected] › mysql:[email protected] › com.google.protobuf:[email protected]
Overview
com.google.protobuf:protobuf-java is a Google's language-neutral, platform-neutral, extensible mechanism for serializing structured data.

Affected versions of this package are vulnerable to Integer Overflow by allowing remote authenticated attackers to cause a heap-based buffer overflow in serialisation process.

[jason-upchurch]

We should consider including

exclude group: 'com.google.protobuf', module: 'protobuf-java'

similar to the way we exclude specific drivers in build.gradle

Need to test this approach

[jason-upchurch]

added exclude group: 'com.google.protobuf', module: 'protobuf-java' to build.gradle and submitted PR #3743