Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump Jackson to v2.9.4 to resolve CVE-2017-15095 et al #66

Closed
wants to merge 1 commit into from

Conversation

alex-dr
Copy link

@alex-dr alex-dr commented Feb 9, 2018

Deletes old versions of jackson from the repository so they don't get
included in the final artifact or show up on security scans.

I really am not very comfortable with how this repo checks in binaries;
I grabbed these from mvnrepository.com, but the author or any other
contributor could have injected their own binaries with any malicious
code they want and 99.999% of consumers (read; everyone running
Logstash) would never know.

For context on upstream fix, see:
https://bugzilla.redhat.com/show_bug.cgi?id=1506612
CVE-2017-17485: FasterXML/jackson-databind#1855
CVE-2018-5968: FasterXML/jackson-databind#1899

Deletes old versions of jackson from the  repository so they don't get
included in the final artifact or show up on security scans.

I really am not very comfortable with how this repo checks in binaries;
I grabbed these from mvnrepository.com, but the author or any other
contributor could have injected their own binaries with any malicious
code they want and 99.999% of consumers (read; everyone running
Logstash) would never know.
@alex-dr alex-dr changed the title Bump Jackson to v2.9.4 to resolve CVE-2017-15095 Bump Jackson to v2.9.4 to resolve CVE-2017-15095 et al Feb 9, 2018
@guyboertje
Copy link
Owner

@alex-dr

Thanks for this.

Just so as you know, the author (me) is employed by Elastic on the Logstash team.

AFAIK, the actual downloading of the jars is done from Maven using the ruby_maven gem and jar_dependencies gems. We trust that these are fetching official jars.

I think the jars, lib/jrjackson_jars.rb and pom.xml should not be checked into the repo. They should be generated at package time.

For that reason I am going to close this and open a new one in reference to this.

@alex-dr
Copy link
Author

alex-dr commented Feb 16, 2018

Thanks @guyboertje , and I'm glad we found a better solution than using untrusted jars I uploaded :)

@alex-dr alex-dr deleted the bump-jackson branch February 16, 2018 18:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants