[CASSANDRA-20093] jackson-databind2.13.2.2 still exists in apache-cassandra-5.0.2

• Type: Bug
• Status: Resolved
• Priority: Urgent
• Resolution: Duplicate
• Severity: Critical
• Platform: All
• Impacts: Security
• Assignee: Unassigned
• Reporter: Kapil Shewate
• Created: 6 days ago 13:25
• Updated: 6 days ago 13:33
• Resolved: 6 days ago 13:33

Description

Component name - jackson-databind
Component version name - 2.13.2.2
CVE-2022-42004 - 7.5
CVE-2023-35116 - 4.7

Archive Context and Path
apache-cassandra-5.0.2/lib/jackson-databind-2.13.2.2.jar

 

Above CVE's are still applicable for the jackson-databind2.13.2.2 in apache-cassandra-5.0.2

CVSS score is 7.5 High

Issue Links

• duplicates: CASSANDRA-17966 jackson-databind vulnerability CVE-2022-42003 CVE-2022-42004