Skip to content

Conversation

@TheSnoozer
Copy link
Collaborator

Context

Includes:

  • update for com.fasterxml.jackson.core: 2.9.9 -> 2.9.9.3
    • https://nvd.nist.gov/vuln/detail/CVE-2019-14379: SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used, leading to remote code execution.
    • https://nvd.nist.gov/vuln/detail/CVE-2019-14439: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Contributor Checklist

  • Added relevant integration or unit tests to verify the changes
  • Update the Readme or any other documentation (including relevant Javadoc)
  • Ensured that tests pass locally: mvn clean package
  • Ensured that the code meets the current checkstyle coding style definition: mvn clean verify -Pcheckstyle -Dmaven.test.skip=true -B

@TheSnoozer TheSnoozer added this to the 3.0.1 milestone Aug 11, 2019
@TheSnoozer TheSnoozer mentioned this pull request Aug 11, 2019
12 tasks
@TheSnoozer TheSnoozer merged commit 8f65b32 into git-commit-id:master Aug 11, 2019
@TheSnoozer TheSnoozer deleted the update-dependencies branch August 11, 2019 19:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant