You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@bookkeeper.apache.org by GitBox <gi...@apache.org> on 2022/03/22 08:24:56 UTC
[GitHub] [bookkeeper] equanz opened a new issue #3134: Security vulnerability in jackson-databind 2.11.0
equanz opened a new issue #3134:
URL: https://github.com/apache/bookkeeper/issues/3134
**BUG REPORT**
***Describe the bug***
`OWASP Dependency Check` job detects the vulnerability in `com.fasterxml.jackson.core/jackson-databind@2.11.0`.
```
One or more dependencies were identified with known vulnerabilities in bookkeeper:
jackson-databind-2.11.0.jar (pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.0, cpe:2.3:a:fasterxml:jackson-databind:2.11.0:*:*:*:*:*:*:*) : CVE-2020-36518
```
https://nvd.nist.gov/vuln/detail/CVE-2020-36518
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [bookkeeper] marcospds edited a comment on issue #3134: Security vulnerability in jackson-databind@2.11.0
Posted by GitBox <gi...@apache.org>.
marcospds edited a comment on issue #3134:
URL: https://github.com/apache/bookkeeper/issues/3134#issuecomment-1076800761
Good afternoon guys, will a fix be created for 2.11.x? Like a 2.11.5 or 2.11.4.1 version. Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [bookkeeper] marcospds commented on issue #3134: Security vulnerability in jackson-databind 2.11.0
Posted by GitBox <gi...@apache.org>.
marcospds commented on issue #3134:
URL: https://github.com/apache/bookkeeper/issues/3134#issuecomment-1076800761
Good afternoon guys, will a fix be created for 2.11.x? Like a 2.11.5 or 2.11.4.1 version? Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [bookkeeper] equanz commented on issue #3134: Security vulnerability in jackson-databind@2.11.0
Posted by GitBox <gi...@apache.org>.
equanz commented on issue #3134:
URL: https://github.com/apache/bookkeeper/issues/3134#issuecomment-1078709257
@marcospds
> will a fix be created for 2.11.x? Like a 2.11.5 or 2.11.4.1 version?
Which does your comment mean, "*Will a fix be created for bookkeeper v2.11.x*" or "*Will a fix be created for jackson-databind v2.11.x*" ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [bookkeeper] nicoloboschi commented on issue #3134: Security vulnerability in jackson-databind 2.11.0
Posted by GitBox <gi...@apache.org>.
nicoloboschi commented on issue #3134:
URL: https://github.com/apache/bookkeeper/issues/3134#issuecomment-1074900005
We have to wait until 2.13.2 is released
https://github.com/FasterXML/jackson-databind/issues/2816#issuecomment-1073483255
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [bookkeeper] eolivelli commented on issue #3134: Security vulnerability in jackson-databind@2.11.0
Posted by GitBox <gi...@apache.org>.
eolivelli commented on issue #3134:
URL: https://github.com/apache/bookkeeper/issues/3134#issuecomment-1079453546
See here https://github.com/apache/bookkeeper/pull/3140
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org