Upgrade Jackson dependencies

[Canos]

Seems a great moment to try to upgrade the dependency since there's important security problems with old jacksons.
Is it possible?

FasterXML/jackson-databind#1723

Thanks in advance.

[msymons]

There are multiple security issues that have been addressed in released version of Jackson. The above reference to Jackson-databind 1723 is actually not the best reference as that issue was closed as a duplicate.

What we do have are fixes for CVE-2017-7525 via:

FasterXML/jackson-databind#1599

Hence jackson:

• 2.6.7.1
• 2.7.9.1
• 2.8.9
• 2.9.0
  (but see below):

There were then later fixes, Firstly: "Blacklist couple more types for deserialization" (the CVE-2017-7525 fix was not quite complete).

FasterXML/jackson-databind#1680

Then there was "Block more JDK types from polymorphic deserialization (CVE 2017-15095)" in:

FasterXML/jackson-databind#1737

Hence, taking all the above, and reading through comments, etc, we seem to have all security fixes released in the following Jackson versions

• 2.7.9.2
• 2.8.10
• 2.9.0

[teodord]

We have upgraded to Jackson 2.9.3 in master branch and this will be part of the next release.

[msymons]

@teodord, I'm afraid that new CVEs have been released, explaining that the fix in Jackson 2.9.3 was incomplete - but addressed in Jackson 2.9.4:

• CVE-2018-5968
• CVE-2017-17485

[teodord]

Upgraded to 2.9.5 now.

[juljog]

Hi,

There is a jackson vulnerability https://nvd.nist.gov/vuln/detail/CVE-2018-1000873 that is addressed in 2.9.8 FasterXML/jackson-modules-java8#90

Possible to upgrade the dependency?

Thanks in advance.

[teodord]

We upgraded to 2.9.8 on master branch and this would be part of a future release.
But I remind you that JasperReports is just a library inside your own Java application, together with many other libraries you need, including Jackson. So the versions for these libraries are pretty much your choice and responsibility, provided that they can work together. Since there is not API change from 2.9.5 to 2.9.8 in Jackson, you can upgrade on your side any time you want. The version of Jackson we include in our build should not matter for you as you include the one you prefer in your own application.

[juljog]

@teodord noted with thanks