`jackson-databind` 2.9.9.1 micro-patch released for 2 CVEs
23 views
Skip to first unread message
Tatu Saloranta
Jul 3, 2019, 10:42:36 AM7/3/19
to jackson-user, jacks...@googlegroups.com, jackson-announce
As per title, `2.9.9.1` of `jackson-databind` was released (ahead of
full `2.9.10` that will take longer), and contains fixes to 2 CVEs (of
polymorphic deser variety, see
https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062).
This is to be used with version 2.9.9 of other components.
-+ Tatu +-
full `2.9.10` that will take longer), and contains fixes to 2 CVEs (of
polymorphic deser variety, see
https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062).
This is to be used with version 2.9.9 of other components.
-+ Tatu +-
Reply all
Reply to author
Forward
0 new messages