You are viewing a plain text version of this content. The canonical link for it is here.

Posted to jira@kafka.apache.org by "Manyanda Chitimbo (Jira)" <ji...@apache.org> on 2023/05/17 14:29:00 UTC

[jira] [Commented] (KAFKA-15000) High vulnerability PRISMA-2023-0067 reported in jackson-core

    [ https://issues.apache.org/jira/browse/KAFKA-15000?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17723486#comment-17723486 ] 

Manyanda Chitimbo commented on KAFKA-15000:
-------------------------------------------

The PR [https://github.com/apache/kafka/pull/13662]  should address the issue. 
Maybe when it is merged it can be backported. 

> High vulnerability PRISMA-2023-0067 reported in jackson-core
> ------------------------------------------------------------
>
>                 Key: KAFKA-15000
>                 URL: https://issues.apache.org/jira/browse/KAFKA-15000
>             Project: Kafka
>          Issue Type: Bug
>    Affects Versions: 3.4.0, 3.3.2
>            Reporter: Arushi Rai
>            Priority: Critical
>
> Kafka is using jackson-core version 2.13.4 which has high vulnerability reported [PRISMA-2023-0067. |https://github.com/FasterXML/jackson-core/pull/827]
> This vulnerability is fix in Jackson-core 2.15.0 and Kafka should upgrade to the same. 



--
This message was sent by Atlassian Jira
(v8.20.10#820010)