This is an automated email from the ASF dual-hosted git repository.
nicoloboschi pushed a commit to branch branch-2.11
in repository https://gitbox.apache.org/repos/asf/pulsar.git
The following commit(s) were added to refs/heads/branch-2.11 by this push:
new 1850bc976c6 [fix][sec] Upgrade jackson-databind to 2.13.4.2 to get rid
of CVE-2022-42003 (#18394)
1850bc976c6 is described below
commit 1850bc976c65201ebf0bf5399a2a9e8a319228e4
Author: Nicolò Boschi <[email protected]>
AuthorDate: Thu Nov 10 16:53:42 2022 +0100
[fix][sec] Upgrade jackson-databind to 2.13.4.2 to get rid of
CVE-2022-42003 (#18394)
* [fix][sec] Upgrade jackson-databind to 2.13.4.2 to get rid of
CVE-2022-42003
* Fix IO jackson dependencies
* Fix IO http
* revert unrelated change
(cherry picked from commit da64346de46638aadcaec43fe530dfe9e8a97141)
---
distribution/server/src/assemble/LICENSE.bin.txt | 2 +-
pom.xml | 2 +-
pulsar-io/dynamodb/pom.xml | 1 -
pulsar-io/kinesis/pom.xml | 1 -
pulsar-sql/presto-distribution/LICENSE | 2 +-
5 files changed, 3 insertions(+), 5 deletions(-)
diff --git a/distribution/server/src/assemble/LICENSE.bin.txt
b/distribution/server/src/assemble/LICENSE.bin.txt
index c6ad542dcbd..30f78a67def 100644
--- a/distribution/server/src/assemble/LICENSE.bin.txt
+++ b/distribution/server/src/assemble/LICENSE.bin.txt
@@ -314,7 +314,7 @@ The Apache Software License, Version 2.0
* Jackson
- com.fasterxml.jackson.core-jackson-annotations-2.13.4.jar
- com.fasterxml.jackson.core-jackson-core-2.13.4.jar
- - com.fasterxml.jackson.core-jackson-databind-2.13.4.jar
+ - com.fasterxml.jackson.core-jackson-databind-2.13.4.2.jar
- com.fasterxml.jackson.dataformat-jackson-dataformat-yaml-2.13.4.jar
- com.fasterxml.jackson.jaxrs-jackson-jaxrs-base-2.13.4.jar
- com.fasterxml.jackson.jaxrs-jackson-jaxrs-json-provider-2.13.4.jar
diff --git a/pom.xml b/pom.xml
index 0f40592f99d..2ee94a541bf 100644
--- a/pom.xml
+++ b/pom.xml
@@ -137,7 +137,7 @@ flexible messaging model and an intuitive client
API.</description>
<log4j2.version>2.18.0</log4j2.version>
<bouncycastle.version>1.69</bouncycastle.version>
<bouncycastlefips.version>1.0.2</bouncycastlefips.version>
- <jackson.version>2.13.4</jackson.version>
+ <jackson.version>2.13.4.20221013</jackson.version>
<reflections.version>0.9.11</reflections.version>
<swagger.version>1.6.2</swagger.version>
<puppycrawl.checkstyle.version>8.37</puppycrawl.checkstyle.version>
diff --git a/pulsar-io/dynamodb/pom.xml b/pulsar-io/dynamodb/pom.xml
index d31b818d06c..564159bd6a0 100644
--- a/pulsar-io/dynamodb/pom.xml
+++ b/pulsar-io/dynamodb/pom.xml
@@ -70,7 +70,6 @@
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-cbor</artifactId>
- <version>${jackson.version}</version>
</dependency>
<dependency>
diff --git a/pulsar-io/kinesis/pom.xml b/pulsar-io/kinesis/pom.xml
index 1ad6ba1d8e8..070429af422 100644
--- a/pulsar-io/kinesis/pom.xml
+++ b/pulsar-io/kinesis/pom.xml
@@ -83,7 +83,6 @@
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-cbor</artifactId>
- <version>${jackson.version}</version>
</dependency>
<dependency>
diff --git a/pulsar-sql/presto-distribution/LICENSE
b/pulsar-sql/presto-distribution/LICENSE
index b019eb269a5..c4ae842b69c 100644
--- a/pulsar-sql/presto-distribution/LICENSE
+++ b/pulsar-sql/presto-distribution/LICENSE
@@ -209,7 +209,7 @@ The Apache Software License, Version 2.0
* Jackson
- jackson-annotations-2.13.4.jar
- jackson-core-2.13.4.jar
- - jackson-databind-2.13.4.jar
+ - jackson-databind-2.13.4.2.jar
- jackson-dataformat-smile-2.13.4.jar
- jackson-datatype-guava-2.13.4.jar
- jackson-datatype-jdk8-2.13.4.jar
