[FLUME-3407] workaround for jackson-mapper-asl-1.9.13.jar @ flume-ng

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Duplicate
• Fix Version/s: 1.10.0
• Component/s: Build

Environment

java 11

• Assignee: Unassigned
• Reporter: alexander kravchik
• Created: 20/Feb/22 11:39
• Updated: 22/Feb/22 16:12
• Resolved: 22/Feb/22 16:12

Description

Dear colleagues, 

we are using log4j2 with flume-ng appender. 

The below vulnerabilities are found in the dependent jackson-mapper-asl-1.9.13.jar :

cve-2019-10202

cve-2019-10172

Please advise if this will be fixed and planned ETA in case it is already fixed

Thanks , 

sasha

 

Issue Links

• duplicates: FLUME-3402 remove org.codehaus.jackson dependencies