You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@zookeeper.apache.org by "symat (via GitHub)" <gi...@apache.org> on 2023/06/30 12:13:53 UTC
[GitHub] [zookeeper] symat opened a new pull request, #2026: ZOOKEEPER-4716: upgrade jackson to 2.15.2, suppress two false positive CVE errors
symat opened a new pull request, #2026:
URL: https://github.com/apache/zookeeper/pull/2026
Our jackson is quite old, I want to upgrade it before release 3.8.2.
Also we have a few false positive CVEs reported by OWASP:
- CVE-2023-35116: according to jackson community, this is not a security issue, see https://github.com/FasterXML/jackson-databind/issues/3972#issuecomment-1596193098
- CVE-2022-45688: the following CVE is not even jackson related, but a vulnerability in json-java which we don't use in ZooKeeper
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] symat commented on pull request #2026: ZOOKEEPER-4716: upgrade jackson to 2.15.2, suppress two false positive CVE errors
Posted by "symat (via GitHub)" <gi...@apache.org>.
symat commented on PR #2026:
URL: https://github.com/apache/zookeeper/pull/2026#issuecomment-1616682914
I also cherry-picked to branch-3.7
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] symat merged pull request #2026: ZOOKEEPER-4716: upgrade jackson to 2.15.2, suppress two false positive CVE errors
Posted by "symat (via GitHub)" <gi...@apache.org>.
symat merged PR #2026:
URL: https://github.com/apache/zookeeper/pull/2026
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [zookeeper] symat commented on pull request #2026: ZOOKEEPER-4716: upgrade jackson to 2.15.2, suppress two false positive CVE errors
Posted by "symat (via GitHub)" <gi...@apache.org>.
symat commented on PR #2026:
URL: https://github.com/apache/zookeeper/pull/2026#issuecomment-1616679268
thanks for the quick reviews!
I'll merge this to branch-3.8 and master.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@zookeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org