[HBASE-23227] Upgrade jackson-databind to 2.9.10.1 to avoid recent CVEs

• Type: Task
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 3.0.0-alpha-1, 2.3.0, 1.6.0, 1.4.12, 2.1.8, 2.2.3
• Component/s: dependencies, REST, security

Release Note

<!-- markdown -->

the Apache HBase REST Proxy now uses Jackson Databind version 2.9.10.1 to address the following CVEs

  - CVE-2019-16942
  - CVE-2019-16943

Users of prior releases with Jackson Databind 2.9.10 are advised to either upgrade to this release or to upgrade their local Jackson Databind jar directly.

• Assignee: Wei-Chiu Chuang
• Reporter: Wei-Chiu Chuang
• Created: 29/Oct/19 11:20
• Updated: 20/Nov/19 23:10
• Resolved: 30/Oct/19 02:53

Description

Several net new CVEs were raised against jackson-databind 2.9.10.

CVE-2019-16942
CVE-2019-16943

2.9.10.1 is released, which I believe addresses these two CVEs.

Issue Links

• links to: GitHub Pull Request #771