You are viewing a plain text version of this content. The canonical link for it is here.

Posted to common-dev@hadoop.apache.org by "Siyao Meng (JIRA)" <ji...@apache.org> on 2019/08/03 01:58:00 UTC

[jira] [Created] (HADOOP-16487) Update jackson-databind to 2.9.9.2

Siyao Meng created HADOOP-16487:
-----------------------------------

             Summary: Update jackson-databind to 2.9.9.2
                 Key: HADOOP-16487
                 URL: https://issues.apache.org/jira/browse/HADOOP-16487
             Project: Hadoop Common
          Issue Type: Bug
            Reporter: Siyao Meng
            Assignee: Siyao Meng


Another CVE in jackson-databind:
https://nvd.nist.gov/vuln/detail/CVE-2019-14379

jackson-databind 2.9.9.2 is available: https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind

Side note: Here's a discussion jira on whether to remove jackson-databind due to the increasing number of CVEs in this dependency recently: HADOOP-16485



--
This message was sent by Atlassian JIRA
(v7.6.14#76016)

---------------------------------------------------------------------
To unsubscribe, e-mail: common-dev-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-dev-help@hadoop.apache.org