You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@knox.apache.org by "Colm O hEigeartaigh (JIRA)" <ji...@apache.org> on 2017/12/12 12:16:00 UTC

[jira] [Updated] (KNOX-1145) Upgrade Jackson due to CVE-2017-7525

     [ https://issues.apache.org/jira/browse/KNOX-1145?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Colm O hEigeartaigh updated KNOX-1145:
--------------------------------------
    Status: Patch Available  (was: Open)

> Upgrade Jackson due to CVE-2017-7525
> ------------------------------------
>
>                 Key: KNOX-1145
>                 URL: https://issues.apache.org/jira/browse/KNOX-1145
>             Project: Apache Knox
>          Issue Type: Improvement
>            Reporter: Colm O hEigeartaigh
>            Assignee: Colm O hEigeartaigh
>             Fix For: 1.0.0
>
>         Attachments: KNOX-1145.patch
>
>
> Apache Knox currently ships the Jackson databind jar version 2.2.2. However, there is a security advisory CVE-2017-7525 released for this component:
> https://github.com/FasterXML/jackson-databind/issues/1599
> We should upgrade Jackson to pick this fix up.



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)