You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@oozie.apache.org by "PJ Fanning (Jira)" <ji...@apache.org> on 2022/01/12 12:27:00 UTC

[jira] [Comment Edited] (OOZIE-3650) upgrade jackson - ideally to v2.13.1

    [ https://issues.apache.org/jira/browse/OOZIE-3650?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17474479#comment-17474479 ] 

PJ Fanning edited comment on OOZIE-3650 at 1/12/22, 12:26 PM:
--------------------------------------------------------------

Latest version of Spark uses jackson 2.12.3 - [https://mvnrepository.com/artifact/org.apache.spark/spark-core_2.13/3.2.0]

[~asalamon74] if you're comfortable that oozie is not vulnerable to any of the jackson deserialization vulnerablities (including Remote Code Execution possibilities) - then feel free to ignore this issue.


was (Author: pj.fanning):
Latest version of Spark uses jackson 2.12.3 - [https://mvnrepository.com/artifact/org.apache.spark/spark-core_2.13/3.2.0]

[~asalamon74] if you're comfortable that oozie is not vulnerable to any of the jackson deserialization vulnerablities - then feel free to ignore this issue.

> upgrade jackson - ideally to v2.13.1
> ------------------------------------
>
>                 Key: OOZIE-3650
>                 URL: https://issues.apache.org/jira/browse/OOZIE-3650
>             Project: Oozie
>          Issue Type: Improvement
>            Reporter: PJ Fanning
>            Priority: Major
>
> Oozie currently has a dependency on an old version of Jackson (2.6.5) - [https://github.com/apache/oozie/blob/master/pom.xml#L119]
> There are a number of CVEs open affecting this version.
> https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.6.5



--
This message was sent by Atlassian Jira
(v8.20.1#820001)