Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update jackson-databind-2.9.6 to the 2.15.* #6122

Closed
muratugureminoglu opened this issue Feb 23, 2024 · 1 comment
Closed

Update jackson-databind-2.9.6 to the 2.15.* #6122

muratugureminoglu opened this issue Feb 23, 2024 · 1 comment
Assignees

Comments

@muratugureminoglu
Copy link
Contributor

jackson-databind-2.9.6 include in ./lib/ehcache-2.10.6.jar and has some vulnertabilities.

@mekya
Copy link
Contributor

mekya commented Mar 21, 2024

After the analysis, we find that there is no jackson-databind-2.9.6 dependency. It's 2.15.3.

After that @muratugureminoglu figured out that one dependency has another dependency(ehcache) and that dependecy list the jackson-databind in the following file.

ehcache-2.10.6.jar > rest-management-private-classpath/META-INF/maven/com.fasterxml.jackson.core/jackson-databind/pom.xml

 <groupId>com.fasterxml.jackson.core</groupId>
  <artifactId>jackson-databind</artifactId>
  <version>2.9.6</version>
  <name>jackson-databind</name>
  <packaging>bundle</packaging>

We don't use the rest api of ehcache so that this warning is a false alarm.

Anyway, we just update ehcache version that has listing for jackson-databind-2.11.1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

No branches or pull requests

3 participants