Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

*** The wcm.io Project is closing down this JIRA Instance in favor of GitHub issues. *** Please use the corresponding GitHub projects to report issues - or the mailing list for general discussion.

Issues

Go to all issues
Select view

Select search mode

 
21 of 21

Update the dependency of jackson-databind due to security vulnerability.

Done

Description

Please refer to the screenshot attached.

Can you please update the dependency of com.fasterxml.jackson.core » jackson-databind as it has one direct vulnerability
Direct vulnerabilities:
CVE-2020-36518 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36518

Currently the latest version is using
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
<version>2.11.4</version>
</dependency>

Version 2.13 onwards for the above is safe.

Attachments

1
  • 20 Jun 2022, 08:24 AM

Details

Assignee

Reporter

Components

Priority

Created June 20, 2022 at 8:31 AM
Updated June 30, 2022 at 1:12 PM
Resolved June 30, 2022 at 1:12 PM
Configure

Activity

Show:

Rituraj SinghJune 30, 2022 at 12:58 PM

Hi Stefan,

Thank you for the input, yes we will handle it on our platform level, so you can close the ticket.

Thanks,

Rituraj Singh

Stefan SeifertJune 21, 2022 at 9:06 AM
Edited

thanks for reaching out - to which of the caravan modules are you referring to with this ticket? https://caravan.wcm.io/

wcm.io caravan is a set of modular OSGi-based libraries. the dependencies that are defined in the Maven POM define, against which interface (OSGi package version) we compile against. we do not ship with this dependencies, this is fully controlled by the OSGi container our modules are deployed to.

it’s OSGi best practice to compile against the lowest-possible version that is minimum required. usually that is not the version that is actually used in the OSGi container.