[
https://issues.apache.org/jira/browse/PARQUET-2127?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17534994#comment-17534994
]
ASF GitHub Bot commented on PARQUET-2127:
-----------------------------------------
braiscouce commented on code in PR #955:
URL: https://github.com/apache/parquet-mr/pull/955#discussion_r870348560
##########
pom.xml:
##########
@@ -73,7 +73,7 @@
<jackson.groupId>com.fasterxml.jackson.core</jackson.groupId>
<jackson.package>com.fasterxml.jackson</jackson.package>
<jackson.version>2.13.2</jackson.version>
- <jackson-databind.version>${jackson.version}</jackson-databind.version>
+ <jackson-databind.version>2.13.2.2</jackson-databind.version>
Review Comment:
jackson-databind has a different versioning. They released two micro-patches
to resolve a CVE.
[Here](https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.13) there is
more information about the release.
> Security risk in latest parquet-jackson-1.12.2.jar
> --------------------------------------------------
>
> Key: PARQUET-2127
> URL: https://issues.apache.org/jira/browse/PARQUET-2127
> Project: Parquet
> Issue Type: Improvement
> Reporter: phoebe chen
> Priority: Major
>
> Embed jackson-databind:2.11.4 has security risk of Possible DoS if using JDK
> serialization to serialize JsonNode
> ([https://github.com/FasterXML/jackson-databind/issues/3328] ), upgrade to
> 2.13.1 can fix this.
--
This message was sent by Atlassian Jira
(v8.20.7#820007)
