[JIRA] (JENKINS-59379) Update jackson-databind to 2.9.9.3

[mark.sym...@weareact.com (JIRA)]

Title: Message Title

Mark Symons updated an issue   Jenkins / JENKINS-59379 Update jackson-databind to 2.9.9.3 Change By: Mark Symons Update {{jackson-databind}} from 2.9.9 to 2.9.9.3 This is to address four separate CVEs, two of which are critical: * [CVE-2019-14379|https://nvd.nist.gov/vuln/detail/2019-14379] (9.8) * [CVE-2019-14439|https://nvd.nist.gov/vuln/detail/2019-14439] (7.5) * [CVE-2019-12384|https://nvd.nist.gov/vuln/detail/2019-12384] (5.9) * [CVE-2019-12814|https://nvd.nist.gov/vuln/detail/2019-12814] (5.9) As {{java-client-api}} uses three separate jackson modules, I suggest addressing problem by using {{jackson-bom}}POM import (2.9.9.20190807) in {{ dependencyManagement }} . Add Comment   This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.201935.1568544591000.3868.1568544660165%40Atlassian.JIRA.