This is an automated email from the ASF dual-hosted git repository.
jgallimore pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/tomee.git
The following commit(s) were added to refs/heads/master by this push:
new c50e075 [TOMEE-2655] updates jackson to 2.9.9.3 (was 2.9.4), see
changelog https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9
(several CVEs are addressed); updates activemq to 5.15.10 (was 5.15.8), no
changelog available
new ec42639 Merge pull request #548 from
rzo1/TOMEE-2655-Vulnerable-Jackson
c50e075 is described below
commit c50e075ab2fe45838710ed5d2c14e937a42f431a
Author: Richard Zowalla <[email protected]>
AuthorDate: Thu Sep 5 12:53:11 2019 +0200
[TOMEE-2655] updates jackson to 2.9.9.3 (was 2.9.4), see changelog
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9 (several CVEs are
addressed); updates activemq to 5.15.10 (was 5.15.8), no changelog available
---
container/openejb-core/pom.xml | 4 ++++
pom.xml | 17 +++++++++++++++--
tomee/tomee-microprofile/mp-common/pom.xml | 3 ---
3 files changed, 19 insertions(+), 5 deletions(-)
diff --git a/container/openejb-core/pom.xml b/container/openejb-core/pom.xml
index 2a45a93..770e346 100644
--- a/container/openejb-core/pom.xml
+++ b/container/openejb-core/pom.xml
@@ -551,6 +551,10 @@
<groupId>org.objectweb.howl</groupId>
<artifactId>howl</artifactId>
</dependency>
+ <dependency>
+ <groupId>com.fasterxml.jackson.core</groupId>
+ <artifactId>jackson-databind</artifactId>
+ </dependency>
<!-- JavaMail -->
<dependency>
<groupId>org.apache.geronimo.specs</groupId>
diff --git a/pom.xml b/pom.xml
index dcc3874..df97501 100644
--- a/pom.xml
+++ b/pom.xml
@@ -177,7 +177,7 @@
<commons-net.version>3.3</commons-net.version>
<bval.version>2.0.3</bval.version>
- <org.apache.activemq.version>5.15.6</org.apache.activemq.version>
+ <org.apache.activemq.version>5.15.10</org.apache.activemq.version>
<org.springframework.version>3.1.4.RELEASE</org.springframework.version>
<junit.version>4.12</junit.version>
<org.apache.axis2.version>1.4.1</org.apache.axis2.version>
@@ -225,7 +225,8 @@
<opentracing.api>0.31.0</opentracing.api>
<!-- Jackson required by OpenAPI Impl -->
- <jackson.version>2.9.4</jackson.version>
+ <jackson.version>2.9.9.3</jackson.version>
+ <jackson.dataformat.version>2.9.9</jackson.dataformat.version>
<!-- Javadoc & Asciidoclet -->
<javadoc.version>3.0.1</javadoc.version>
@@ -1858,6 +1859,18 @@
</exclusion>
</exclusions>
</dependency>
+ <!-- Jackson required by OpenAPI Impl and ActiveMQ Broker -->
+ <dependency>
+ <groupId>com.fasterxml.jackson.core</groupId>
+ <artifactId>jackson-databind</artifactId>
+ <version>${jackson.version}</version>
+ </dependency>
+ <!-- Jackson required by OpenAPI Impl -->
+ <dependency>
+ <groupId>com.fasterxml.jackson.dataformat</groupId>
+ <artifactId>jackson-dataformat-yaml</artifactId>
+ <version>${jackson.dataformat.version}</version>
+ </dependency>
</dependencies>
</dependencyManagement>
diff --git a/tomee/tomee-microprofile/mp-common/pom.xml
b/tomee/tomee-microprofile/mp-common/pom.xml
index 4530be7..3a775fa 100644
--- a/tomee/tomee-microprofile/mp-common/pom.xml
+++ b/tomee/tomee-microprofile/mp-common/pom.xml
@@ -168,13 +168,10 @@
<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-yaml</artifactId>
- <version>${jackson.version}</version>
</dependency>
-
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
- <version>${jackson.version}</version>
</dependency>
<dependency>
