[Bug report] Security Vulnerability CVE-2022-2390 in play-services-basement

[DanielKispert]

Describe the bug
Looking at your artifact on mvnrepository, I noticed that the compile dependency play-services-basement is vulnerable to CVE-2022-2390. Is there a new version in the works to fix this?

https://mvnrepository.com/artifact/com.google.mlkit/face-detection/16.1.5

SDK Info:

• SDK Name & Version: https://mvnrepository.com/artifact/com.google.mlkit/face-detection/16.1.5

Development Environment:

• Android

[jackqdyulei]

Hi DanielKispert, thanks for your report and this is definitely something we should fix.

To unblock you I wonder whether you can first depend on higher version of play-services-basement in your build.gradle. In this way your app should auto-resolve to new play-services-basement to fix the security issue.

Once we release new SDK, I will update this thread so you can remove your direct dependency

[ai-plays]

This is fixed https://developers.google.com/ml-kit/release-notes#improvements