[HBASE-23075] Upgrade jackson to version 2.9.10 due to CVE-2019-16335 and CVE-2019-14540

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.0.0-alpha-1, 2.3.0, hbase-connectors-1.0.1, 2.1.7, 2.2.2
• Component/s: dependencies, hbase-connectors, REST, security
• Hadoop Flags: Reviewed
• Assignee: Nicholas Jiang
• Reporter: Nicholas Jiang
• Created: 25/Sep/19 11:58
• Updated: 24/Jun/22 17:55
• Resolved: 26/Sep/19 03:40

Description

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
https://nvd.nist.gov/vuln/detail/CVE-2019-16335
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
https://nvd.nist.gov/vuln/detail/CVE-2019-14540

Issue Links

• is related to: HBASE-23174 Upgrade jackson and jackson-databind to 2.9.10 (branch-1)
• is related to: HBASE-23069 periodic dependency bump for Sep 2019
• links to: GitHub Pull Request #45
• links to: GitHub Pull Request #660