You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@hudi.apache.org by "Raymond Xu (Jira)" <ji...@apache.org> on 2022/05/09 09:00:00 UTC

[jira] [Updated] (HUDI-195) Bump jackson-databind to prevent deserialization loophole

     [ https://issues.apache.org/jira/browse/HUDI-195?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Raymond Xu updated HUDI-195:
----------------------------
    Epic Link: HUDI-3529  (was: HUDI-2668)

> Bump jackson-databind to prevent deserialization loophole
> ---------------------------------------------------------
>
>                 Key: HUDI-195
>                 URL: https://issues.apache.org/jira/browse/HUDI-195
>             Project: Apache Hudi
>          Issue Type: Task
>          Components: code-quality, writer-core
>            Reporter: vinoyang
>            Assignee: vinoyang
>            Priority: Major
>
> In Tencent, we can not use 2.6.4 of com.fasterxml.jackson.core:jackson-databind. Because it exists deserialization loophole. The description of loophole is here: [https://www.cnvd.org.cn/flaw/show/CNVD-2017-04483] (unfortunately, it's a Chinese web page).
> We recommend up to 2.7.9.2, 2.8.11 or 2.9.4+.



--
This message was sent by Atlassian Jira
(v8.20.7#820007)