[CASSANDRA-17966] jackson-databind vulnerability CVE-2022-42003 CVE-2022-42004

• Type: Bug
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 3.11.14, 4.0.7, 4.1-rc1, 5.0-alpha1, 5.0
• Component/s: Dependencies
• Bug Category: Security
• Severity: Normal
• Complexity: Normal
• Discovered By: User Report
• Platform: All
• Since Version: NA

Source Control Link

https://github.com/apache/cassandra/commit/2e6528542b21a5d79eeba6d22ddc2a289805f98c

Test and Documentation Plan

run CI

• Assignee: Brandon Williams
• Reporter: Brandon Williams

Authors

Brandon Williams

Reviewers

Stefan Miklosovic

• Created: 17/Oct/22 14:55
• Updated: Yesterday 11:41
• Resolved: 18/Oct/22 15:40

Description

As the summary says, jackson-databind 2.13.2.2 which was upgraded for a vulnerability in CASSANDRA-17556 is vulnerable again.

Issue Links

• is duplicated by: CASSANDRA-20093 jackson-databind2.13.2.2 still exists in apache-cassandra-5.0.2
• is duplicated by: CASSANDRA-18081 CVE's in Cassandra 4.0.7