On 12/8/2017 9:41 PM, info...@unixcert.net wrote: > It looks like the Jackson-databind issue is only associated with 2.5.X > versions of Struts.
It's only with 2.5.14. Addressed in 2.5.14.1. But both 2.5.(x<14) and 2.3.x are impacted by S2-054. > I just want to confirm that 2.3.X versions are not. No they are not if you did not manually use Jackson-databind. Hope these help, Yasser.
