[HADOOP-17094] vulnerabilities reported in jackson and jackson-databind in branch-2.10

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.10.0, 2.10.1
• Fix Version/s: 2.10.1
• Target Version/s: 2.10.1
• Hadoop Flags: Reviewed
• Assignee: Ahmed Hussein
• Reporter: Ahmed Hussein
• Created: 25/Jun/20 17:24
• Updated: 30/Jun/20 04:30
• Resolved: 30/Jun/20 03:21

Description

There are known vulnerabilities in the com.fasterxml.jackson.core:jackson-databind package [,2.9.10.5).

List of vulnerabilities.

Upgrading jackson and jackson-databind to 2.10 should get rid of those vulnerabilities.