Upgrade libs to prevent security issues - CVE

[byjoaofilipe]

It was identified by OWASP dependency-checker tool that exists vulnerabilities in:

<!-- https://mvnrepository.com/artifact/net.sf.jasperreports/jasperreports -->
<dependency>
    <groupId>net.sf.jasperreports</groupId>
    <artifactId>jasperreports</artifactId>
    <version>6.16.0</version>
</dependency>

CVE-2020-25649

To prevent this security issues, please, upgrade to the latest version the following libraries (see image below):

[teodord]

It is not clear to me to which version should we upgrade?
Is it specified anywhere that this was solved/fixed in subsequent release of Jackson Databind?

[byjoaofilipe]

Hello @teodord

If you want to solve this security issues, you can upgrade to this version (latest version):
https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.12.2

With this upgrade, you mitigate/prevent the risks.
Thank you.

[teodord]

Thanks for the quick reply.

But is there a way to have written confirmation that this particular CVE is solved in this particular version?
How do we know is fixed? Who said so and where?

[teodord]

Indeed, the Github CVE link you provided above had the required information.

Thank you,
Teodor