Skip to content

Commit

Permalink
Fix the security vulnerability from jackcon databind
Browse files Browse the repository at this point in the history
### What changes are proposed in this pull request?

fix https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36518


### Why are the changes needed?
jackson-databind before 2.13.0 allows a Java StackOverflow exception and
denial of service via a large depth of nested objects.

### Does this PR introduce any user facing changes?

no

pr-link: #15665
change-id: cid-86cd0a45edccad7edb68e0c07329473c4f177566
  • Loading branch information
beinan authored Jun 7, 2022
1 parent 0b4e233 commit bf6b068
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@

package alluxio.proxy.s3;

import com.fasterxml.jackson.annotation.JsonInclude;
import com.fasterxml.jackson.annotation.JsonPropertyOrder;
import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty;
import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement;
Expand All @@ -24,6 +25,7 @@
*/
@JacksonXmlRootElement(localName = "CompleteMultipartUploadResult")
@JsonPropertyOrder({ "Location", "Bucket", "Key", "ETag" })
@JsonInclude(JsonInclude.Include.NON_EMPTY)
public class CompleteMultipartUploadResult {
/* The URI that identifies the newly created object. */
private String mLocation;
Expand Down
2 changes: 1 addition & 1 deletion pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@
<protobuf.version>3.19.2</protobuf.version>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<slf4j.version>1.7.30</slf4j.version>
<jackson.version>2.11.1</jackson.version>
<jackson.version>2.13.3</jackson.version>
<hadoop-cos.version>3.1.0-5.8.5</hadoop-cos.version>
<cos_api.version>5.6.19</cos_api.version>
<surefire.forkCount>2</surefire.forkCount>
Expand Down

0 comments on commit bf6b068

Please sign in to comment.