This is an automated email from the ASF dual-hosted git repository.
nicoloboschi pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pulsar.git
The following commit(s) were added to refs/heads/master by this push:
new da64346de46 [fix][sec] Upgrade jackson-databind to 2.13.4.2 to get rid
of CVE-2022-42003 (#18394)
da64346de46 is described below
commit da64346de46638aadcaec43fe530dfe9e8a97141
Author: Nicolò Boschi <[email protected]>
AuthorDate: Thu Nov 10 16:53:42 2022 +0100
[fix][sec] Upgrade jackson-databind to 2.13.4.2 to get rid of
CVE-2022-42003 (#18394)
* [fix][sec] Upgrade jackson-databind to 2.13.4.2 to get rid of
CVE-2022-42003
* Fix IO jackson dependencies
* Fix IO http
* revert unrelated change
---
distribution/server/src/assemble/LICENSE.bin.txt | 2 +-
pom.xml | 2 +-
pulsar-io/dynamodb/pom.xml | 1 -
pulsar-io/http/pom.xml | 1 -
pulsar-io/kinesis/pom.xml | 1 -
pulsar-sql/presto-distribution/LICENSE | 2 +-
6 files changed, 3 insertions(+), 6 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt
b/distribution/server/src/assemble/LICENSE.bin.txt
index 7c42dc260ea..c0dc66a9035 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -248,7 +248,7 @@ The Apache Software License, Version 2.0
* Jackson
- com.fasterxml.jackson.core-jackson-annotations-2.13.4.jar
- com.fasterxml.jackson.core-jackson-core-2.13.4.jar
- - com.fasterxml.jackson.core-jackson-databind-2.13.4.jar
+ - com.fasterxml.jackson.core-jackson-databind-2.13.4.2.jar
- com.fasterxml.jackson.dataformat-jackson-dataformat-yaml-2.13.4.jar
- com.fasterxml.jackson.jaxrs-jackson-jaxrs-base-2.13.4.jar
- com.fasterxml.jackson.jaxrs-jackson-jaxrs-json-provider-2.13.4.jar
diff --git a/pom.xml b/pom.xml
index 88b6933cb75..dd69f4f71a0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -140,7 +140,7 @@ flexible messaging model and an intuitive client
API.</description>
<log4j2.version>2.18.0</log4j2.version>
<bouncycastle.version>1.69</bouncycastle.version>
<bouncycastlefips.version>1.0.2</bouncycastlefips.version>
- <jackson.version>2.13.4</jackson.version>
+ <jackson.version>2.13.4.20221013</jackson.version>
<reflections.version>0.9.11</reflections.version>
<swagger.version>1.6.2</swagger.version>
<puppycrawl.checkstyle.version>8.37</puppycrawl.checkstyle.version>
diff --git a/pulsar-io/dynamodb/pom.xml b/pulsar-io/dynamodb/pom.xml
index 4028bbf5dde..86a8fbbf958 100644
--- a/pulsar-io/dynamodb/pom.xml
+++ b/pulsar-io/dynamodb/pom.xml
@@ -70,7 +70,6 @@
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-cbor</artifactId>
- <version>${jackson.version}</version>
</dependency>
<dependency>
diff --git a/pulsar-io/http/pom.xml b/pulsar-io/http/pom.xml
index cd5a38d0ada..b190b0f5cc1 100644
--- a/pulsar-io/http/pom.xml
+++ b/pulsar-io/http/pom.xml
@@ -51,7 +51,6 @@
<dependency>
<groupId>com.fasterxml.jackson.datatype</groupId>
<artifactId>jackson-datatype-jsr310</artifactId>
- <version>${jackson.version}</version>
</dependency>
<dependency>
diff --git a/pulsar-io/kinesis/pom.xml b/pulsar-io/kinesis/pom.xml
index ffdab2e8fed..245df9d5c9c 100644
--- a/pulsar-io/kinesis/pom.xml
+++ b/pulsar-io/kinesis/pom.xml
@@ -83,7 +83,6 @@
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-cbor</artifactId>
- <version>${jackson.version}</version>
</dependency>
<dependency>
diff --git a/pulsar-sql/presto-distribution/LICENSE
b/pulsar-sql/presto-distribution/LICENSE
index fa3b1ba7de6..273791f5fc5 100644
--- a/pulsar-sql/presto-distribution/LICENSE
+++ b/pulsar-sql/presto-distribution/LICENSE
@@ -209,7 +209,7 @@ The Apache Software License, Version 2.0
* Jackson
- jackson-annotations-2.13.4.jar
- jackson-core-2.13.4.jar
- - jackson-databind-2.13.4.jar
+ - jackson-databind-2.13.4.2.jar
- jackson-dataformat-smile-2.13.4.jar
- jackson-datatype-guava-2.13.4.jar
- jackson-datatype-jdk8-2.13.4.jar
