[GEODE-10432] Jackson-databind 2.13.2.2 has security vulnerabilities. Recommend upgrade to 2.13.4.2.

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.15.0
• Labels: needsTriage
• Assignee: Unassigned
• Reporter: Alastair
• Created: 01/Nov/22 18:37
• Updated: 01/Nov/22 18:37

Description

In Geode 1.15.0, Jackson-databind 2.13.2.2 has known security vulnerabilities. These issues are both fixed in 2.13.4.2.

 

HIGH	CVE-2022-42004 (BDSA-2022-2768) CVE-2022-42004 (nist.gov)	Jackson Databind Vulnerable to Denial-of-Service (DoS) via Resource Exhaustion in 'BeanDeserializer' Component	Fixed in 2.13.4
HIGH	CVE-2022-42003 (BDSA-2022-2765) CVE-2022-42003 (nist.gov)	Jackson Databind Vulnerable to Denial-of-Service (DoS) via Resource Exhaustion in Primitive Value Deserializers	Fixed in 2.13.4.2