Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade jackson-databind in Main Standalone Jar #15748

Open
mn-mikke opened this issue Sep 12, 2023 · 2 comments · May be fixed by #15749 or #16169
Open

Upgrade jackson-databind in Main Standalone Jar #15748

mn-mikke opened this issue Sep 12, 2023 · 2 comments · May be fixed by #15749 or #16169
Assignees
Milestone

Comments

@mn-mikke
Copy link
Collaborator

mn-mikke commented Sep 12, 2023

The current version has the following vulnerabilities.:

  • PRISMA-2023-0067
@mn-mikke
Copy link
Collaborator Author

This feature will require support for Java 19. Putting on hold for now.

@mn-mikke mn-mikke modified the milestones: 3.44.0.1, 3.46.0.1 Sep 18, 2023
@wendycwong
Copy link
Contributor

wendycwong commented Jan 30, 2024

Hello, I am building an application using h2o but my container scanner has flagged a vulnerability for one of your Java dependencies (com.fasterxml.jackson.core). Could you please bump the version from 2.14.2 to 2.15.0 in the next release? Below you will see the output of the scanner. Thanks!

"vulnerabilities": [
{
"CVE": "PRISMA-2023-0067",
"CVSS": "7.50",
"Fixed On": "24 Apr 23 00:00 UTC",
"Link": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=PRISMA-2023-0067",
"Package Name": "com.fasterxml.jackson.core_jackson-core",
"Package Type": "Java",
"Package Version": "2.14.2",
"Severity": "high",
"Status": "fixed in 2.15.0"
}]

support ticket: https://support.h2o.ai/a/tickets/107321
https://support.h2o.ai/a/tickets/104745

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
4 participants