Skip to content
This repository has been archived by the owner on Jan 31, 2025. It is now read-only.

Vulnerabilities in Jackson Mapper ASL used by Jet 4.3 #2913

Closed
olukas opened this issue Feb 23, 2021 · 3 comments
Closed

Vulnerabilities in Jackson Mapper ASL used by Jet 4.3 #2913

olukas opened this issue Feb 23, 2021 · 3 comments
Labels
security Pull requests that address a security vulnerability severity:critical Vulnerability scan classification for Critical Severity issues
Milestone
4.3.1

Comments

@olukas
Copy link
Collaborator

olukas commented Feb 23, 2021

Jet uses Jackson Mapper ASL 1.9.13 which includes following vulnerabilities:
@olukas olukas added the security Pull requests that address a security vulnerability label Feb 23, 2021
@olukas olukas added this to the 4.3.1 milestone Feb 23, 2021
@degerhz degerhz added the severity:critical Vulnerability scan classification for Critical Severity issues label Feb 24, 2021
@gurbuzali
Copy link

gurbuzali commented Mar 1, 2021 •
edited
Loading

two of our extensions depend on this library:

  • avro
  • hadoop

For avro extension, we depend on org.apache.avro:avro:1.8.2 which depends on this library.
We can fix the issues by moving to avro 1.10.1 which depends on Jackson Databind library 2.11.3 (which Jackson Mapper library moved to)

For hadoop extension, we currently use Hadoop 2.10.0 which depends on this library. We could exclude the library from Hadoop and then add it as a separate library but the mentioned fixed version is not available in the main maven repo. The next patch version of Hadoop does not fix the issue, we may need to move to Hadoop 3.x for a fix

@gurbuzali
Copy link

On second thought (thanks @frant-hartm for the tip), we don't distribute Hadoop in our hadoop extension, so it should not be an issue.

@gurbuzali gurbuzali mentioned this issue Mar 1, 2021
Merged
4 tasks
@gurbuzali
Copy link

closed via #2937

@olukas olukas mentioned this issue Apr 8, 2021
Open
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
security Pull requests that address a security vulnerability severity:critical Vulnerability scan classification for Critical Severity issues
Projects
None yet
Milestone
4.3.1
Development

No branches or pull requests
3 participants
@gurbuzali @olukas @degerhz