Uploaded image for project: 'Hadoop Common'
  1. Hadoop Common
  2. HADOOP-16891

Upgrade jackson-databind to 2.9.10.3

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Blocker
    • Resolution: Fixed
    • None
    • 3.3.0, 2.9.3, 3.1.4, 3.2.2, 2.10.1
    • None
    • None

    Description

      New RCE found in jackson-databind 2.0.0 through 2.9.10.2.

      Patched in 2.9.10.3. Looks critical.

      After HADOOP-16882 get in we should backport this to those lower-version branches ASAP.

      Attachments

        Issue Links

          is duplicated by

          Improvement - An improvement or enhancement to an existing feature or task. HADOOP-16883 update jackon-databind version

          • Major - Major loss of function.
          • Resolved
          is related to

          Improvement - An improvement or enhancement to an existing feature or task. HADOOP-16485 Remove dependency on jackson

          • Major - Major loss of function.
          • Open
          links to

          Web Link GitHub Pull Request #1865

          Activity

            People

              smeng Siyao Meng
              smeng Siyao Meng
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: