[HADOOP-16891] Upgrade jackson-databind to 2.9.10.3

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 3.3.0, 2.9.3, 3.1.4, 3.2.2, 2.10.1
• Target Version/s: 3.3.0, 3.1.4, 3.2.2
• Assignee: Siyao Meng
• Reporter: Siyao Meng
• Created: 27/Feb/20 19:49
• Updated: 04/Mar/20 17:29
• Resolved: 29/Feb/20 01:08

Description

New RCE found in jackson-databind 2.0.0 through 2.9.10.2.

Patched in 2.9.10.3. Looks critical.

After HADOOP-16882 get in we should backport this to those lower-version branches ASAP.

Issue Links

• is duplicated by: HADOOP-16883 update jackon-databind version
• is related to: HADOOP-16485 Remove dependency on jackson
• links to: GitHub Pull Request #1865