Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.
Sign upUpdate jackson-databind version; resolves #279. #280
Conversation
ruebot
requested review from
lintool and
ianmilligan1
Oct 16, 2018
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
ruebot
Oct 16, 2018
Member
We got a notice for 2.8.11.1 as well, but I'm not seeing it in our pom.xml or here:
[nruest@wombat:aut] (git)-[issue-279]-$ mvn dependency:tree | grep databind
[INFO] +- com.fasterxml.jackson.core:jackson-databind:jar:2.8.9:compile
|
We got a notice for 2.8.11.1 as well, but I'm not seeing it in our |
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
codecov-io
Oct 16, 2018
Codecov Report
Merging #280 into master will not change coverage.
The diff coverage isn/a.
@@ Coverage Diff @@
## master #280 +/- ##
=======================================
Coverage 70.36% 70.36%
=======================================
Files 41 41
Lines 1046 1046
Branches 192 192
=======================================
Hits 736 736
Misses 244 244
Partials 66 66Continue to review full report at Codecov.
Legend - Click here to learn more
Δ = absolute <relative> (impact),ø = not affected,? = missing data
Powered by Codecov. Last update f19dc9a...a9b14a4. Read the comment docs.
codecov-io
commented
Oct 16, 2018
Codecov Report
@@ Coverage Diff @@
## master #280 +/- ##
=======================================
Coverage 70.36% 70.36%
=======================================
Files 41 41
Lines 1046 1046
Branches 192 192
=======================================
Hits 736 736
Misses 244 244
Partials 66 66Continue to review full report at Codecov.
|
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
|
If this looks good to you as well @lintool I can merge? |
ianmilligan1
merged commit 72cb5e2
into
archivesunleashed:master
Oct 16, 2018
ruebot
deleted the
ruebot:issue-279
branch
Oct 16, 2018
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
ruebot
Oct 16, 2018
Member
Looks like there was a third follow-up to this alert. 2.8.9 is bad too.
FasterXML jackson-databind before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.
I'll update again
|
Looks like there was a third follow-up to this alert. 2.8.9 is bad too.
I'll update again |
ruebot commentedOct 16, 2018
GitHub issue(s): #279
What does this Pull Request do?
Update jackson-databind version for CVE-2017-752.
How should this be tested?