You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@zookeeper.apache.org by Andor Molnár <an...@apache.org> on 2026/08/27 21:02:55 UTC

Jackson-databind upgrade on master

Hi all,

OWASP build is working again on master, thanks to Yurii!
We upgraded Jetty and JLine recently, now only jackson-databind is flagged on the branch.

15:52:44 jackson-databind-2.18.8.jar (pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8, cpe:2.3:a:fasterxml:jackson-core:2.18.8:*:*:*:*:*:*:*, cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*, cpe:2.3:a:fasterxml:jackson-modules-java8:2.18.8:*:*:*:*:*:*:*) : CVE-2026-54515

Somebody willing to upgrade it?

Regards,

Andor

Re: Jackson-databind upgrade on master

Posted by Andor Molnár <an...@apache.org>.
Merged.

Thanks David!



> On Aug 31, 2026, at 05:03, Dávid Paksy <pa...@apache.org> wrote:
> 
> Hi Andor,
> 
> Sure, opened https://issues.apache.org/jira/browse/ZOOKEEPER-5083 and a PR
> for this.
> 
> Can you please have a look?
> 
> Many thanks,
> Dávid
> 
> Andor Molnár <an...@apache.org> ezt írta (időpont: 2026. aug. 27., Cs,
> 23:03):
> 
>> Hi all,
>> 
>> OWASP build is working again on master, thanks to Yurii!
>> We upgraded Jetty and JLine recently, now only jackson-databind is flagged
>> on the branch.
>> 
>> 15:52:44 jackson-databind-2.18.8.jar
>> (pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8,
>> cpe:2.3:a:fasterxml:jackson-core:2.18.8:*:*:*:*:*:*:*,
>> cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*,
>> cpe:2.3:a:fasterxml:jackson-modules-java8:2.18.8:*:*:*:*:*:*:*) :
>> CVE-2026-54515
>> 
>> Somebody willing to upgrade it?
>> 
>> Regards,
>> 
>> Andor
>> 
>> 
>>

Re: Jackson-databind upgrade on master

Posted by Dávid Paksy <pa...@apache.org>.
Hi Andor,

Sure, opened https://issues.apache.org/jira/browse/ZOOKEEPER-5083 and a PR
for this.

Can you please have a look?

Many thanks,
Dávid

Andor Molnár <an...@apache.org> ezt írta (időpont: 2026. aug. 27., Cs,
23:03):

> Hi all,
>
> OWASP build is working again on master, thanks to Yurii!
> We upgraded Jetty and JLine recently, now only jackson-databind is flagged
> on the branch.
>
> 15:52:44 jackson-databind-2.18.8.jar
> (pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8,
> cpe:2.3:a:fasterxml:jackson-core:2.18.8:*:*:*:*:*:*:*,
> cpe:2.3:a:fasterxml:jackson-databind:2.18.8:*:*:*:*:*:*:*,
> cpe:2.3:a:fasterxml:jackson-modules-java8:2.18.8:*:*:*:*:*:*:*) :
> CVE-2026-54515
>
> Somebody willing to upgrade it?
>
> Regards,
>
> Andor
>
>
>