[GHSA-7xpr-hc2w-34m9] Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service

[tal-sealsecurity]

Updates

• Affected products
• Description

Comments
wire-runtime-jvm is not discontinued
as seen on maven https://mvnrepository.com/artifact/com.squareup.wire/wire-runtime-jvm

why the vuln is not on wire-runtime

• the package com.squareup.wire:wire-runtime does not contain code. it ships only KMP metadata, no bytecode.
• it links to wire-runtime-jvm via the .module file
  https://repo1.maven.org/maven2/com/squareup/wire/wire-runtime/5.2.0/wire-runtime-5.2.0.module
• wire-runtime jar has no code, depending on it pulls in the vulnerable wire-runtime-jvm, which has the vuln

wire-runtime is the root module, but the vuln is on wire-runtime-jvm

[github]

Hi there @oldergod! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory