New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Jackson to 2.13.3 #5067

Closed

JonathanLennox opened this issue May 17, 2022 · 1 comment · Fixed by #5076

Labels

JonathanLennox commented May 17, 2022

Jackson 2.13.0 has a CVE filed against it: CVE-2020-36518. It's fixed in 2.13.3.

kolbma commented May 28, 2022

The CVE says first in text before 2.13.0...
And below in Known Affected Software Configurations

Up to (excluding) 2.12.6.1 (there exists also 2.12.7)
And >= 2.13.0 < 2.13.2.1

https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind

jansupol added the CQ required label

senivam linked a pull request

that will close this issue

Update Jackson to 2.13.3 #5076

Merged

senivam closed this as completed in #5076

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment