[JIRA] (JENKINS-59379) Update jackson-databind to 2.9.9.3

[mark.symons@weareact.com (JIRA)]

Mark Symons created an issue

Jenkins / JENKINS-59379 Update jackson-databind to 2.9.9.3 Issue Type: Bug Assignee: Karl-Heinz Marbaise Components: java-client-api Created: 2019-09-15 10:49 Labels: security Priority: Critical Reporter: Mark Symons Update jackson-databind from 2.9.9 to 2.9.9.3 This is to address four separate CVEs, two of which are critical: CVE-2019-14379 (9.8) CVE-2019-14439 (7.5) CVE-2019-12384 (5.9) CVE-2019-12814 (5.9) As java-client-api uses three separate jackson modules, I suggest addressing problem by using {{jackson-bom}}POM import (2.9.9.20190807) in dependencyManagement. Add Comment

This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f)

[mark.symons@weareact.com (JIRA)]

Mark Symons updated an issue

Jenkins / JENKINS-59379 Update jackson-databind to 2.9.9.3

Change By: Mark Symons

Update {{jackson-databind}} from 2.9.9 to 2.9.9.3 This is to address four separate CVEs, two of which are critical:

* [CVE-2019-14379|https://nvd.nist.gov/vuln/detail/2019-14379] (9.8) * [CVE-2019-14439|https://nvd.nist.gov/vuln/detail/2019-14439] (7.5) * [CVE-2019-12384|https://nvd.nist.gov/vuln/detail/2019-12384] (5.9) * [CVE-2019-12814|https://nvd.nist.gov/vuln/detail/2019-12814] (5.9) As {{java-client-api}} uses three separate jackson modules, I suggest addressing problem by using {{jackson-bom}}POM import (2.9.9.20190807) in {{ dependencyManagement }} .

Add Comment

[mark.symons@weareact.com (JIRA)]

Mark Symons commented on JENKINS-59379

Re: Update jackson-databind to 2.9.9.3 Submitted pull request: https://github.com/jenkinsci/java-client-api/pull/427

Add Comment