[CASSANDRA-16462] Upgrade to Jackson Databind 2.9.10.8 or later fix high vulnerabilities

• Type: Improvement
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 3.11.11, 4.0-rc1, 4.0
• Component/s: Dependencies
• Change Category: Quality Assurance
• Complexity: Low Hanging Fruit
• Platform: All

Source Control Link

https://github.com/apache/cassandra/commit/a66246f9e8289e383a08c1fc863b39c3a22ad254

Test and Documentation Plan

CI

• Assignee: Brandon Williams
• Reporter: Bhargav Joshi

Authors

Brandon Williams

Reviewers

Andres de la Peña

• Created: 19/Feb/21 19:51
• Updated: 12/Aug/21 22:03
• Resolved: 04/Mar/21 14:16

Description

There are 22 high CVEs

CVE ID | Severity | Packages | Source Package | Fixed Package Version
– | – | – | – | –
CVE-2020-24750 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.6
CVE-2020-24616 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.6
CVE-2020-14195 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.5
CVE-2020-14062 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.5
CVE-2020-14061 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.5
CVE-2020-14060 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.5
CVE-2020-35491 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.8
CVE-2020-35490 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.8
CVE-2020-35728 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.8
CVE-2021-20190 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.7
CVE-2020-25649 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.10.5.1, 2.9.10.7, 2.6.7.4
CVE-2020-36187 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.8
CVE-2020-36188 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.8
CVE-2020-36189 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.8
CVE-2020-36186 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.8
CVE-2020-36185 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.8
CVE-2020-36183 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.8
CVE-2020-36184 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.8
CVE-2020-36182 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.8
CVE-2020-36179 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.8
CVE-2020-36180 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.8
CVE-2020-36181 | high | com.fasterxml.jackson.core_jackson-databind | 2.9.10.4 | fixed in 2.9.10.8

Issue Links

• is duplicated by: CASSANDRA-16734 Remediate Cassandra 3.11.10 JAR dependency vulnerabilities