Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security Vulnerability - Jackson #302

Closed
aabashkin opened this issue Feb 12, 2018 · 5 comments
Closed

Security Vulnerability - Jackson #302

aabashkin opened this issue Feb 12, 2018 · 5 comments
Milestone
0.9.1

Comments

@aabashkin
Copy link

Please upgrade to Jackson databind 2.8.11 or 2.9.4 to address an important security vulnerability: FasterXML/jackson-databind#1904
RyanBard pushed a commit to RyanBard/jjwt that referenced this issue Mar 2, 2018
closes jwtk#302: Update jackson version
420e2b2 
* Updates jacksone-databind version to 2.8.11.1 to fix CVE-2017-17485

Signed-off-by: John Bard <[email protected]>
RyanBard pushed a commit to RyanBard/jjwt that referenced this issue Mar 2, 2018
closes jwtk#302: Update jackson version
c7561b6 
* Updates jackson-databind version to 2.8.11.1 to fix CVE-2017-17485

Signed-off-by: John Bard <[email protected]>
@RyanBard
Copy link
Contributor

RyanBard commented Mar 2, 2018

PR: #306

@glebsts
Copy link

glebsts commented Mar 15, 2018

Can it be prioritized, mb minor version release? Quite scary to live with that.

@lhazlewood
Copy link
Contributor

lhazlewood commented Mar 16, 2018 •
edited
Loading

We'll get it out when we can, for sure. In the meantime, the quick workaround is using a maven <exclude> directive when depending on JJWT and then explicitly using the Jackson version you want to as a runtime dependency.

@tjo tjo mentioned this issue Apr 16, 2018
Closed
4 tasks
lhazlewood added a commit that referenced this issue Jul 5, 2018
@lhazlewood
Merge pull request #306 from RyanBard/Issue302_UpdateJackson
caa2a64 
closes #302: Update jackson version
@lhazlewood lhazlewood added this to the 0.9.1 milestone Jul 5, 2018
@lhazlewood
Copy link
Contributor

Merged to 0.9.x branch pending release.

@lhazlewood
Copy link
Contributor

0.9.1 has been released. Please allow 15-30 minutes for the release to propagate to Maven Central.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
0.9.1
Development

No branches or pull requests
4 participants
@lhazlewood @glebsts @RyanBard @aabashkin