Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Vulnerabilities in Jackson Mapper ASL used by Jet master #3016

Open
olukas opened this issue Apr 8, 2021 · 1 comment
Open

Vulnerabilities in Jackson Mapper ASL used by Jet master #3016

olukas opened this issue Apr 8, 2021 · 1 comment
Labels
security Pull requests that address a security vulnerability severity:critical Vulnerability scan classification for Critical Severity issues

Comments

@olukas
Copy link
Collaborator

olukas commented Apr 8, 2021

Jet hazelcast-jet-files-azure uses Jackson Mapper ASL 1.9.13 which includes following vulnerabilities:

It is the same issue as in #2913 however hazelcast-jet-files-azure was not part of 4.3.x hence it seems we forget to apply the changes also to this module.
@olukas olukas added security Pull requests that address a security vulnerability severity:critical Vulnerability scan classification for Critical Severity issues labels Apr 8, 2021
@olukas olukas added this to the 4.5 milestone Apr 8, 2021
@gurbuzali
Copy link

hazelcast-jet-files-azure depends on org.apache.hadoop:hadoop-azure:jar:3.3.0 which depends on org.codehaus.jackson:jackson-mapper-asl:jar:1.9.13. we use latest version for hadoop-azure and the mentioned fixed version (1.9.13-2) is not available in maven-central. the library is moved to com.fasterxml.jackson.core:jackson-databind, that's why it is not in the maven-central most probably.

@gurbuzali gurbuzali modified the milestones: 4.5, 4.5.1 Apr 12, 2021
@degerhz degerhz modified the milestones: 4.5.1, 4.5.2 Sep 14, 2021
@olukas olukas mentioned this issue Sep 20, 2021
Closed
@frant-hartm frant-hartm modified the milestones: 4.5.2, 4.5.3 Dec 15, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
security Pull requests that address a security vulnerability severity:critical Vulnerability scan classification for Critical Severity issues
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@gurbuzali @olukas @frant-hartm @degerhz