[HADOOP-18178] Upgrade jackson to 2.13.2 and jackson-databind to 2.13.2.2. CVE-2020-36518

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.2
• Fix Version/s: 3.3.3
• Component/s: build, security
• Labels: pull-request-available
• Target Version/s: 3.4.0, 3.3.5
• Assignee: PJ Fanning
• Reporter: PJ Fanning
• Created: 26/Mar/22 12:03
• Updated: 09/Aug/22 12:00
• Resolved: 11/Apr/22 05:58

Description

CVE-2020-36518
https://github.com/FasterXML/jackson-databind/issues/2816

Issue Links

• is depended upon by: HADOOP-18393 Hadoop 3.3.2 has CVEs coming from dependencies
• is depended upon by: HADOOP-18198 Release Hadoop 3.3.3: hadoop-3.3.2 with some fixes
• is duplicated by: HADOOP-18212 hadoop-client-runtime latest version 3.3.2 has security issues
• relates to: HADOOP-18033 Upgrade fasterxml Jackson to 2.13.0
• links to: GitHub Pull Request #4111
• links to: GitHub Pull Request #4147
• links to: GitHub Pull Request #4153
• links to: GitHub Pull Request #4544