Jackson databind release 2.9.10.2

Radek Kraus

unread,

Jan 2, 2020, 7:37:09 PM1/2/20

to jackson-user

Hello,
is there a plan to release jackson-databind:2.9.10.2?
Release, which fixed CVE vulnerabilities (https://github.com/FasterXML/jackson-databind/issues/2526)

Thank you.
Radek Kraus.

Tatu Saloranta

unread,

Jan 2, 2020, 7:51:59 PM1/2/20

to jackson-user

On Thu, Jan 2, 2020 at 4:37 PM Radek Kraus <radek...@gmail.com> wrote:

Hello,
is there a plan to release jackson-databind:2.9.10.2?
Release, which fixed CVE vulnerabilities (https://github.com/FasterXML/jackson-databind/issues/2526)

Yeah -- I have been waiting to see if there are any other fixes, but might as well go ahead and release it now, followed soon by 2.10.2. Latter will hopefully allow others who are stuck with 2.9 to upgrade, and get out of CVE-update-cycle.

-+ Tatu +-

Tatu Saloranta

unread,

Jan 2, 2020, 8:17:09 PM1/2/20

to jackson-user

Version 2.9.10.2 of `jackson-databind` now released, on its way to Maven Central.

I also released matching `jackson-bom` with version `2.9.10.20200103`.

-+ Tatu +-

Radek Kraus

unread,

Jan 3, 2020, 3:54:56 AM1/3/20

to jackson-user

Great. Thank you very much.

Radek Kraus.

Reply all

Reply to author

Forward