The latest version of the `BundleTool` library (1.18.0) is still vulnerable to the `CVE-2024-7254` security vulnerability

[hjcfilho]

The latest version of the BundleTool library (1.18.0) is still vulnerable to the CVE-2024-7254 security vulnerability. This vulnerability comes from the protobuf-java dependency and has affected the BundleTool library for several years.

Many organizations enforce strict policies against using binaries with known security vulnerabilities. Please consider updating the protobuf-java dependency used by the BundleTool library from version 3.22.3 to at least 3.25.5 to address this issue.

[hjcfilho]

I have also created an IssueTracker ticket for this issue.

[byron-hawkins]

Please also include jose4j version 0.9.6 to fix CVE-2024-29371, which was also published 2 years ago and has never been addressed.

We are running bundletool on a public-facing server and are currently patching these vulnerabilities in the released jars. Security is not a priority for google, but for those who use google tools, it can often be quite a high priority.