[
https://issues.apache.org/jira/browse/HUDI-195?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Raymond Xu updated HUDI-195:
----------------------------
Sprint: 2022/05/16
> Bump jackson-databind to prevent deserialization loophole
> ---------------------------------------------------------
>
> Key: HUDI-195
> URL: https://issues.apache.org/jira/browse/HUDI-195
> Project: Apache Hudi
> Issue Type: Task
> Components: code-quality, writer-core
> Reporter: vinoyang
> Assignee: liujinhui
> Priority: Major
>
> In Tencent, we can not use 2.6.4 of
> com.fasterxml.jackson.core:jackson-databind. Because it exists
> deserialization loophole. The description of loophole is here:
> [https://www.cnvd.org.cn/flaw/show/CNVD-2017-04483] (unfortunately, it's a
> Chinese web page).
> We recommend up to 2.7.9.2, 2.8.11 or 2.9.4+.
--
This message was sent by Atlassian Jira
(v8.20.7#820007)
