[
https://issues.apache.org/jira/browse/DRILL-7681?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Derek Lohnes updated DRILL-7681:
--------------------------------
Description:
Vulnerability in dependency jackson-mapper-asl-1.9.13.jar
Max CVSS: 7.5 (High)
Total # CVEs: 1
Note: This is the last release of jackson-mapper-asl before it was moved /
renamed to jackson-databind from 2013. While there is only one known CVE, the
fix for that is to upgrade to jackson-databind. It is likely many of the same
issue impacting databind impact mapper as well.
[https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Afasterxml&cpe_product=cpe%3A%2F%3Afasterxml%3Ajackson-mapper-asl&cpe_version=cpe%3A%2F%3Afasterxml%3Ajackson-mapper-asl%3A1.9.13]
Is this vulnerability exploitable from Apache Drill?
was:
Vulnerability in dependency jackson-mapper-asl-1.9.13.jar
Max CVSS: 7.5 (High)
Total # CVEs: 1
Note: This is the last release of jackson-mapper-asl before it was moved /
renamed to jackson-databind from 2013. While there is only one known CVE, the
fix for that is to upgrade to jackson-databind. It is likely many of the same
issue impacting databind impact mapper as well.
[https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Afasterxml&cpe_product=cpe%3A%2F%3Afasterxml%3Ajackson-mapper-asl&cpe_version=cpe%3A%2F%3Afasterxml%3Ajackson-mapper-asl%3A1.9.13]
> Vulnerability in dependency jackson-mapper-asl-1.9.13.jar
> ---------------------------------------------------------
>
> Key: DRILL-7681
> URL: https://issues.apache.org/jira/browse/DRILL-7681
> Project: Apache Drill
> Issue Type: Bug
> Affects Versions: 1.17.0
> Reporter: Derek Lohnes
> Priority: Major
>
> Vulnerability in dependency jackson-mapper-asl-1.9.13.jar
> Max CVSS: 7.5 (High)
> Total # CVEs: 1
> Note: This is the last release of jackson-mapper-asl before it was moved /
> renamed to jackson-databind from 2013. While there is only one known CVE, the
> fix for that is to upgrade to jackson-databind. It is likely many of the same
> issue impacting databind impact mapper as well.
> [https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Afasterxml&cpe_product=cpe%3A%2F%3Afasterxml%3Ajackson-mapper-asl&cpe_version=cpe%3A%2F%3Afasterxml%3Ajackson-mapper-asl%3A1.9.13]
>
> Is this vulnerability exploitable from Apache Drill?
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
