[HDFS-15741] Vulnerability fixes needed for Jackson Hadoop dependency library

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Duplicate
• Affects Version/s: 3.1.1
• Component/s: security
• Assignee: Unassigned
• Reporter: Souryakanta Dwivedy
• Created: 21/Dec/20 08:13
• Updated: 24/Apr/22 15:46
• Resolved: 24/Apr/22 15:46

Description

Vulnerability fixes need for Jackson Hadoop dependency library 

Below are the Jackson library jars used for hadoop where CVEs are found

Jackson [version 2.10.3 ]

• jackson-core-2.10.3.jar

CVE details :- [  CVE-2020-25649  ]
======================

Jackson-core [version 2.4.0 ]

• htrace-core-3.1.0-incubating.jar

CVE details :- [ CVE-2020-24616 ]
================ =====