[KYLIN-3372] Upgrade jackson-databind version due to security concerns

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: v2.4.0, v2.3.2
• Assignee: Chao Long
• Reporter: Ted Yu
• Created: 09/May/18 00:14
• Updated: 25/Jun/18 07:05
• Resolved: 01/Jun/18 07:35

Description

• https://nvd.nist.gov/vuln/detail/CVE-2018-5968
• https://nvd.nist.gov/vuln/detail/CVE-2018-7489
• https://nvd.nist.gov/vuln/detail/CVE-2017-7525
• https://nvd.nist.gov/vuln/detail/CVE-2017-17485
• https://nvd.nist.gov/vuln/detail/CVE-2017-15095

We should either remove the dependency or upgrade to version 2.8.11.1 or the latest, if possible.

Issue Links

• is duplicated by: KYLIN-3027 Upgrade Jackson version
• links to: GitHub Pull Request #144