[HADOOP-16487] Update jackson-databind to 2.9.9.2

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 3.3.0, 3.2.2
• Target Version/s: 3.3.0
• Assignee: Siyao Meng
• Reporter: Siyao Meng
• Created: 03/Aug/19 01:57
• Updated: 10/Oct/19 06:43
• Resolved: 05/Aug/19 03:04

Description

Another CVE in jackson-databind:
https://nvd.nist.gov/vuln/detail/CVE-2019-14379

jackson-databind 2.9.9.2 is available: https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind

Side note: Here's a discussion jira on whether to remove jackson-databind due to the increasing number of CVEs in this dependency recently: HADOOP-16485

Issue Links

• is related to: HADOOP-16533 Update jackson-databind to 2.9.9.3
• relates to: HADOOP-16451 Update jackson-databind to 2.9.9.1
• relates to: HADOOP-16485 Remove dependency on jackson