[DRILL-7679] Vulnerabilities in dependency htrace-core4-4.1.0-incubating.jar (shaded: com.fasterxml.jackson.core:jackson-databind:2.4.0)

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.17.0
• Fix Version/s: 1.20.1
• Assignee: Unassigned
• Reporter: Derek Lohnes
• Created: 31/Mar/20 18:46
• Updated: 13/Jul/22 09:23
• Resolved: 13/Jul/22 09:23

Description

Vulnerabilities in dependency htrace-core4-4.1.0-incubating.jar (shaded: com.fasterxml.jackson.core:jackson-databind:2.4.0)
 

Max CVSS Score: 9.8 (Critical)

Total # CVEs: 20

Note: The issue with htrace is its use of Jackson Databind.

https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Afasterxml&cpe_product=cpe%3A%2F%3Afasterxml%3Ajackson-databind&cpe_version=cpe%3A%2F%3Afasterxml%3Ajackson-databind%3A2.4.0

 

Are these vulnerabilities exploitable from Apache Drill?