giscience / graphhopper Goto Github PK

The URL of cigar is currently set as http://srtm.csi.cgiar.org/wp-content/uploads/files/srtm_5x5/TIFF/ . This URL causes a redirect to https with the following URL https://srtm.csi.cgiar.orgwp-content/uploads/files/srtm_5x5/TIFF/

Which is an invalid URL. I think we need to change it to https://srtm.csi.cgiar.org/wp-content/uploads/files/srtm_5x5/TIFF/

protobuf
used for reading the pbf file with osmosis. Upgrading protobuf doesn't change anything.

• https://www.cve.org/CVERecord?id=CVE-2021-22569
• https://www.cve.org/CVERecord?id=CVE-2022-3509
• https://www.cve.org/CVERecord?id=CVE-2022-3171

The source of this problem is this issue - probably to be fixed in GraphHopperStorage.java, L417 ff.
by appending to the flush()-method:

        if (conditionalAccess != null) {
            conditionalAccess.flush();
        }
        if (conditionalSpeed != null) {
            conditionalSpeed.flush();
        }

similar as is being done in the close()-method.

Right now no tests are executed with PRs. We should have that.

Introduce a fix to the problem described in graphhopper#1557.

Post-GIScience/openrouteservice#396 cleanup.

xmlgraphics-commons includes the following CVE

• https://www.cve.org/CVERecord?id=CVE-2020-11988

The idea is to remove this fork entirely by either

a) creating pull requests to graphhopper main repository if the feature has potential for the community
b) removing the change if possibly not needed anymore
c) adding wrappers in ORS directly

org.apache.commons:commons-compress is a dependency from us.dustinj.timezonemap.
Forcing an upgrade to commons-compress seems to work. This is our dependency for the timezone stuff.

this will fix the following CVEs

• https://www.cve.org/CVERecord?id=CVE-2021-36090
• https://www.cve.org/CVERecord?id=CVE-2021-35516
• https://www.cve.org/CVERecord?id=CVE-2021-35515
• https://www.cve.org/CVERecord?id=CVE-2021-35517

We use the https://github.com/dustin-johnson/timezonemap package. It is long abandoned and slowly picking up vulnerabilities. Either we find a replacement or fork and upgrade the relevant packages ourselves.

Doing PRs to the original repo seems not reasonable due to the devs' inactivity.

Vulnerabilities can be seen here: https://mvnrepository.com/artifact/us.dustinj.timezonemap/timezonemap/4.5