Two more c3p0 gadgets to exploit default typing issue [CVE-2018-7489] #1931

[DKumars]

Hi Team ,

As we are using jackson-databind 2.9.4 in our production system and we got one vulnerability in it
"Two more c3p0 gadgets to exploit default typing issue [CVE-2018-7489] #1931" as mentioned in #1931 tag. For this fix , please let us know when we can have new release like 2.9.5 or patch for this fix as 2.9.4.1and its now very important for our product. Please help to share new release date for this fix.
-Regards,
Dharmendra

[vdotjansen]

If I interpret the #1972 (comment) from @cowtowncoder I think it should be release this month.

[cowtowncoder]

@DKumars Please do not use issue tracker for asking questions. This is literally what mailing lists are for:

https://groups.google.com/forum/#!forum/jackson-user

(or jackson-dev)

As to 2.9.5, release is starting now and all components should be available within next 24 hours, excluding Scala module (which takes longer as there's no active maintainer).

[DKumars]

Thanks for your response, Please share the link from where i can find official release for this fix.

…

On Mon, Mar 26, 2018 at 9:08 PM, Tatu Saloranta ***@***.***> wrote: @DKumars <https://github.com/DKumars> Please do not use issue tracker for asking questions. This is literally what mailing lists are for: https://groups.google.com/forum/#!forum/jackson-user (or jackson-dev) As to 2.9.5, release is starting now and all components should be available within next 24 hours, excluding Scala module (which takes longer as there's no active maintainer). — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1984 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AEamLupg-2gBY08LFrUKz5eA0klhoeS2ks5tiQt2gaJpZM4S6vdM> .

-- -regards, Dharmendra

[vdotjansen]

@DKumars Have you checked both the public maven repositories and the releases button on github?
Please be aware that maven repositories search engines (like for example https://search.maven.org/ and https://mvnrepository.com/ ) are often delayed.

[DKumars]

Its visible at https://mvnrepository.com/ but not at https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind.
Anyways Thanks for your update

[cowtowncoder]

Yes, Maven Central is where releases always go.

Announcements are done on Twitter (@fasterxml) and on mailing lists (https://groups.google.com/forum/#!forum/jackson-user and .../jackson-dev)