Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update jackson-version to 2.8.9 #2274

Closed
msymons opened this issue Jun 24, 2017 · 2 comments
Closed

Update jackson-version to 2.8.9 #2274

msymons opened this issue Jun 24, 2017 · 2 comments

Comments

@msymons
Copy link
Contributor

msymons commented Jun 24, 2017

swagger-core currently (v1.5.15) uses jackson-databind v2.8.7. Update this by incrementing jackson-version to 2.8.9.

Addresses Jackson Deserializer security vulnerability:

FasterXML/jackson-databind#1599
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.8.9
@msymons msymons mentioned this issue Jun 24, 2017
Merged
@melloware
Copy link

Looks like FasterXML has more CVE Security issues:

https://www.cvedetails.com/vulnerability-list/vendor_id-15866/product_id-34008/Fasterxml-Jackson.html

https://www.cvedetails.com/vulnerability-list/vendor_id-15866/product_id-42991/Fasterxml-Jackson-databind.html

Even affects the latest version 2.9.8 available by internet.

@frantuma
Copy link
Member

obsolete

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@melloware @msymons @frantuma