This is an automated email from the ASF dual-hosted git repository.
jgallimore pushed a commit to branch tomee-7.1.x
in repository https://gitbox.apache.org/repos/asf/tomee.git
The following commit(s) were added to refs/heads/tomee-7.1.x by this push:
new f4b388d [TOMEE-2655] [7.1.x] updates jackson to 2.9.9.3 (was 2.9.4),
see changelog https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9
(several CVEs are addressed); updates activemq to 5.15.10 (was 5.15.8), no
changelog available
new 0efc647 Merge pull request #549 from
rzo1/7.1.x-TOMEE-2655-Vulnerable-Jackson
f4b388d is described below
commit f4b388d5bebf667b5b7f8d80797ebe6a44d3f936
Author: Richard Zowalla <[email protected]>
AuthorDate: Thu Sep 5 13:59:04 2019 +0200
[TOMEE-2655] [7.1.x] updates jackson to 2.9.9.3 (was 2.9.4), see changelog
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9 (several CVEs are
addressed); updates activemq to 5.15.10 (was 5.15.8), no changelog available
---
container/openejb-core/pom.xml | 4 ++++
pom.xml | 13 ++++++++++++-
tomee/tomee-plume-webapp/pom.xml | 1 -
tomee/tomee-plus-webapp/pom.xml | 1 -
4 files changed, 16 insertions(+), 3 deletions(-)
diff --git a/container/openejb-core/pom.xml b/container/openejb-core/pom.xml
index f7f349e..7f982b2 100644
--- a/container/openejb-core/pom.xml
+++ b/container/openejb-core/pom.xml
@@ -547,6 +547,10 @@
<groupId>org.objectweb.howl</groupId>
<artifactId>howl</artifactId>
</dependency>
+ <dependency>
+ <groupId>com.fasterxml.jackson.core</groupId>
+ <artifactId>jackson-databind</artifactId>
+ </dependency>
<!-- JavaMail -->
<dependency>
<groupId>org.apache.geronimo.javamail</groupId>
diff --git a/pom.xml b/pom.xml
index 1e2cc42..f8c4e6e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -170,7 +170,7 @@
<commons-net.version>3.3</commons-net.version>
<bval.version>1.1.2</bval.version>
- <org.apache.activemq.version>5.15.8</org.apache.activemq.version>
+ <org.apache.activemq.version>5.15.10</org.apache.activemq.version>
<org.springframework.version>3.1.4.RELEASE</org.springframework.version>
<junit.version>4.12</junit.version>
<org.apache.axis2.version>1.4.1</org.apache.axis2.version>
@@ -191,6 +191,8 @@
<version.eclipselink>2.6.4</version.eclipselink>
<version.groovy>2.4.12</version.groovy>
+ <jackson.version>2.9.9.3</jackson.version>
+
<!-- arquillian related -->
<version.arquillian.bom>1.1.13.Final</version.arquillian.bom>
<version.shrinkwrap.resolver.bom>2.1.0</version.shrinkwrap.resolver.bom>
@@ -1041,6 +1043,10 @@
<artifactId>jackson-core-mapper</artifactId>
</exclusion>
<exclusion>
+ <groupId>com.fasterxml.jackson.core</groupId>
+ <artifactId>jackson-databind</artifactId>
+ </exclusion>
+ <exclusion>
<groupId>org.apache.hadoop</groupId>
<artifactId>hadoop-core</artifactId>
</exclusion>
@@ -1769,6 +1775,11 @@
</exclusion>
</exclusions>
</dependency>
+ <dependency>
+ <groupId>com.fasterxml.jackson.core</groupId>
+ <artifactId>jackson-databind</artifactId>
+ <version>${jackson.version}</version>
+ </dependency>
</dependencies>
</dependencyManagement>
diff --git a/tomee/tomee-plume-webapp/pom.xml b/tomee/tomee-plume-webapp/pom.xml
index 84fa4a2..d8ab3b8 100644
--- a/tomee/tomee-plume-webapp/pom.xml
+++ b/tomee/tomee-plume-webapp/pom.xml
@@ -145,7 +145,6 @@
</exclusion>
</exclusions>
</dependency>
-
<!-- if i'm not mistaken we decided to remove it from our default
deliveries
<dependency>
<groupId>${project.groupId}</groupId>
diff --git a/tomee/tomee-plus-webapp/pom.xml b/tomee/tomee-plus-webapp/pom.xml
index a6d18cc..4a033df 100644
--- a/tomee/tomee-plus-webapp/pom.xml
+++ b/tomee/tomee-plus-webapp/pom.xml
@@ -144,7 +144,6 @@
<version>${jcs.version}</version>
<scope>runtime</scope>
</dependency>
-
<!-- if i'm not mistaken we decided to remove it from our default
deliveries
<dependency>
<groupId>${project.groupId}</groupId>
