Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport fix for CVE-2023-4863 to release branch 0.4.x #134

Open
fgrilli opened this issue Sep 29, 2023 · 3 comments
Open

Backport fix for CVE-2023-4863 to release branch 0.4.x #134

fgrilli opened this issue Sep 29, 2023 · 3 comments

Comments

@fgrilli
Copy link

fgrilli commented Sep 29, 2023

v0.5.0 has been released which should contain binaries built from v1.3.2 tag.

Thanks you for bringing the issue to my attention, I missed that Internet got broken recently 😅

Thanks again for fixing this!
Hopefully it's not asking too much but would it be possible to release a 0.4.2 patch version without this breaking change?
Our codebase still requires Java 1.8 and after updating to v0.5.0 we're getting lots of
java.lang.NoClassDefFoundError: Could not initialize class javax.imageio.ImageIO 💥

Originally posted by @fgrilli in #131 (comment)

@fgrilli fgrilli changed the title Backport fix for CVE-2023-4863 to version 0.4.x Backport fix for CVE-2023-4863 to release branch 0.4.x Sep 29, 2023
@mateuszkwiecinski
Copy link
Member

Hey 👋 I'm afraid this cannot be easily done :/ The CI pipeline isn't prepared to build from any commit, and that's not an area I'd like to invest my free time.
I'm willing to bring back Java 8 compatibility, but only in a form of a Multi-Release Jar format. I can't share any time frame when I'll be able to work on this, nor if I'm even capable to achieve such end result 😅

If you need Java 8 support and you cannot upgrade Java version in the nearest future, I can suggest forking the project and building your own jars. It shouldn't be that difficult since there were no changes in the native bindings, so you can even probably re-use native binaries without building them yourself.

Just out fo curiosity: Would you mind sharing why your codebase had stuck on such an old Java runtime? What kind of challenges you have to deal with before you can safelt upgrade to more recent version?

@fgrilli
Copy link
Author

fgrilli commented Oct 2, 2023

Hey, thanks for your reply. I guess we'll have to bite the bullet and build our own jars. As to why we're still stuck with Java 1.8, basically it's for maintenance and compatibility needs but we're also working on modernising our tech stack at the same time.

@ThexXTURBOXx
Copy link

For anyone wondering: My fork is completely compatible with Java 8 and can be built with jitpack: https://github.com/ThexXTURBOXx/webp-imageio

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

3 participants