Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vulnerability Reported in jackson-databind 2.6 #151

Closed
randallwhitman opened this issue Feb 22, 2018 · 8 comments
Closed

Vulnerability Reported in jackson-databind 2.6 #151

randallwhitman opened this issue Feb 22, 2018 · 8 comments

Comments

@randallwhitman
Copy link
Contributor

An issue was filed today on Spatial Framework for Hadoop regarding a vulnerability in jackson-databind 2.6 version - Esri/spatial-framework-for-hadoop#146.
In order to use a new Jackson version, Spatial Framework needs the Geometry API to be compatible with a suitable newer version of Jackson.

@randallwhitman
Copy link
Contributor Author

Information on the vulnerability says it is fixed in 2.6.7.1 and 2.8.9, among other versions of Jackson.

@stolstov
Copy link
Member

@randallwhitman when making this change we also should remove DepFiles folder with the jar files from the repo.

@stolstov
Copy link
Member

stolstov commented Mar 5, 2018

@randallwhitman Should we fix this as well for the next release?

@randallwhitman
Copy link
Contributor Author

Yes, when we make a release, let's definitely include this.
The deployed version of Jackson would matter more than the compile-dependency version.
Nevertheless, we should use the patched versions for the dependency, which will show up in dependency lists/trees.
(what do you think should be the next release - v2.1 maybe?)

@stolstov
Copy link
Member

stolstov commented Mar 5, 2018

@randallwhitman Please, review my pull request. As a warning, people who relied on ant build would have to copy the jars manually.

@stolstov
Copy link
Member

stolstov commented Mar 5, 2018

@alocke Could you verify this?

@alocke
Copy link
Member

alocke commented Mar 6, 2018

Yes, I will.

@stolstov
Copy link
Member

stolstov commented Mar 6, 2018

Thank you Annette!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants