You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cassandra.apache.org by "Lerh Chuan Low (JIRA)" <ji...@apache.org> on 2018/05/04 02:56:00 UTC
[jira] [Comment Edited] (CASSANDRA-14427) Bump jackson version to
>= 2.9.5
[ https://issues.apache.org/jira/browse/CASSANDRA-14427?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16463246#comment-16463246 ]
Lerh Chuan Low edited comment on CASSANDRA-14427 at 5/4/18 2:55 AM:
--------------------------------------------------------------------
Updated the patch, turns out I missed a few things.
The 2.2 CI failed, but it seems unrelated. I tried running the test locally, it works, so trying again:
https://circleci.com/gh/juiceblender/cassandra/84
Updated 2.1 CCI:
https://circleci.com/gh/juiceblender/cassandra/85
was (Author: lerh low):
Updated the patch, turns out I missed a few things.
The 2.2 CI failed, but it seems unrelated. I tried running the test locally, it works, so trying again:
https://circleci.com/gh/juiceblender/cassandra/82
Updated 2.1 CCI:
https://circleci.com/gh/juiceblender/cassandra/81
> Bump jackson version to >= 2.9.5
> --------------------------------
>
> Key: CASSANDRA-14427
> URL: https://issues.apache.org/jira/browse/CASSANDRA-14427
> Project: Cassandra
> Issue Type: Improvement
> Reporter: Lerh Chuan Low
> Assignee: Lerh Chuan Low
> Priority: Major
> Attachments: 2.1-14427.txt, 2.2-14427.txt, 3.0-14427.txt, 3.X-14427.txt, trunk-14427.txt
>
>
> The Jackson being used by Cassandra is really old (1.9.2, and still references codehaus (Jackson 1) instead of fasterxml (Jackson 2)).
> There have been a few jackson vulnerabilities recently (mostly around deserialization which allows arbitrary code execution)
> [https://nvd.nist.gov/vuln/detail/CVE-2017-7525]
> [https://nvd.nist.gov/vuln/detail/CVE-2017-15095]
> [https://nvd.nist.gov/vuln/detail/CVE-2018-1327]
> [https://nvd.nist.gov/vuln/detail/CVE-2018-7489]
> Given that Jackson in Cassandra is really old and seems to be used also for reading in values, it looks worthwhile to update Jackson to 2.9.5.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org