[
https://issues.apache.org/jira/browse/TOMEE-2655?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jonathan Gallimore reassigned TOMEE-2655:
-----------------------------------------
Assignee: Richard Zowalla
> Depends on vulnerable Jackson Version
> -------------------------------------
>
> Key: TOMEE-2655
> URL: https://issues.apache.org/jira/browse/TOMEE-2655
> Project: TomEE
> Issue Type: Bug
> Affects Versions: 7.1.1, 8.0.0-M3
> Reporter: Robert Schaft
> Assignee: Richard Zowalla
> Priority: Critical
> Labels: easyfix, security
>
> TomEE 7.1.1 depends on jackson-databind 2.9.6
> TomEE 8.0.0-M3 ships an even older version 2.9.4.
> All jackson versions up to 2.9.9.1 are vulnerable. Vulnerabilities in this
> component are hard to mitigate, because it is likly that it parses network
> data.
> This issue currently blocks my company from using TomEE out of the box.
--
This message was sent by Atlassian Jira
(v8.3.2#803003)
