[FLINK-15864] Upgrade jackson-databind dependency to 2.10.1 for security reasons

• Type: Sub-task
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 1.10.0
• Component/s: Deployment / Kubernetes
• Labels: pull-request-available
• Assignee: Till Rohrmann
• Reporter: Till Rohrmann
• Created: 03/Feb/20 11:18
• Updated: 07/Feb/20 11:18
• Resolved: 04/Feb/20 15:31

Description

The module flink-kubernetes defines an explicit dependency on jackson-databind:2.9.8. This is problematic since this jackson version contains security vulnerabilities. See FLINK-14104 for more information.

If possible, I would suggest to remove the explicit version tag and to rely on the parent's dependency management.

Issue Links

• links to: GitHub Pull Request #11000