You are viewing a plain text version of this content. The canonical link for it is here.

Posted to user@ignite.apache.org by Andrew Story <an...@fico.com> on 2020/09/18 23:22:18 UTC

Critical security vulnerability for /opt/ignite/apache-ignite/libs/optional/ignite-rest-http/jackson-databind-2.9.6.jar

Would it be possible in the next release of Ignite to upgrade the 3rd party
component
/opt/ignite/apache-ignite/libs/optional/ignite-rest-http/jackson-databind-2.9.6.jar
to jackson-databind-2.11.2.jar or greater?
This .jar is also present in
/opt/ignite/apache-ignite/libs/optional/ignite-kubernetes/ and may be in
other optional folders as well.

This component jackson-databind-2.9.6.jar is flagged as having numerous
critical, high and medium security vulnerabilities, one of which is
described here:
https://nvd.nist.gov/vuln/detail/CVE-2019-14540

I can provide a more complete list of vulnerabilities if that helps.

The latest version of this component appears to be 2.11.2 which should
resolve these vulnerabilities:
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.11.2 

Note if there is a better way to provide this information/request please let
me know.

Thanks,

Andrew Story



--
Sent from: http://apache-ignite-users.70518.x6.nabble.com/

Re: Critical security vulnerability for /opt/ignite/apache-ignite/libs/optional/ignite-rest-http/jackson-databind-2.9.6.jar

Posted by Andrew Story <an...@fico.com>.

Thanks very much Ilya. I have created defect:
https://issues.apache.org/jira/browse/IGNITE-13601



--
Sent from: http://apache-ignite-users.70518.x6.nabble.com/

Re: Critical security vulnerability for /opt/ignite/apache-ignite/libs/optional/ignite-rest-http/jackson-databind-2.9.6.jar

Posted by Ilya Kasnacheev <il...@gmail.com>.

Hello!

Please file an issue against Apache Ignite JIRA:
https://issues.apache.org/jira/browse/IGNITE

Regards,
-- 
Ilya Kasnacheev


сб, 19 сент. 2020 г. в 02:22, Andrew Story <an...@fico.com>:

> Would it be possible in the next release of Ignite to upgrade the 3rd party
> component
>
> /opt/ignite/apache-ignite/libs/optional/ignite-rest-http/jackson-databind-2.9.6.jar
> to jackson-databind-2.11.2.jar or greater?
> This .jar is also present in
> /opt/ignite/apache-ignite/libs/optional/ignite-kubernetes/ and may be in
> other optional folders as well.
>
> This component jackson-databind-2.9.6.jar is flagged as having numerous
> critical, high and medium security vulnerabilities, one of which is
> described here:
> https://nvd.nist.gov/vuln/detail/CVE-2019-14540
>
> I can provide a more complete list of vulnerabilities if that helps.
>
> The latest version of this component appears to be 2.11.2 which should
> resolve these vulnerabilities:
> https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.11.2
>
> Note if there is a better way to provide this information/request please
> let
> me know.
>
> Thanks,
>
> Andrew Story
>
>
>
> --
> Sent from: http://apache-ignite-users.70518.x6.nabble.com/
>