Bump vulnerable transitive jackson-databind dependency#1810
Merged
Conversation
Contributor
Author
|
Upstream kafka patch: |
lmr3796
force-pushed
the
migrate_to_kafka_2_5
branch
from
March 31, 2022 17:48
9902ee8 to
4b4930b
Compare
Contributor
Author
|
Build scan shows dependency got upgraded |
efeg
reviewed
Mar 31, 2022
lmr3796
force-pushed
the
migrate_to_kafka_2_5
branch
from
March 31, 2022 18:10
4b4930b to
2005180
Compare
efeg
reviewed
Mar 31, 2022
efeg
left a comment
efeg
left a comment
Collaborator
There was a problem hiding this comment.
Thanks for the update -- left one more comment.
lmr3796
force-pushed
the
migrate_to_kafka_2_5
branch
from
March 31, 2022 19:39
2005180 to
84e2682
Compare
There's a vulnerability in jackson-databind CVE-2020-36518, which gets resolved in jackson-databind 2.12.6.1+/2.13.1+. Cruise control transitively pulls vulnerable jackson version via Apache Kafka 3.1.0. Apache Kafka 3.1.1 has the fix (See KAFKA-13775), but it is not yet released. We can remove this pin and bump into 3.1.1 to resolve this after Kafka 3.1.1 is released.
lmr3796
force-pushed
the
migrate_to_kafka_2_5
branch
from
March 31, 2022 19:53
84e2682 to
cdf4938
Compare
efeg
pushed a commit
to efeg/cruise-control
that referenced
this pull request
Mar 31, 2022
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
There's a vulnerability in
jackson-databindCVE-2020-36518, which getsresolved in
jackson-databind2.12.6.1+/2.13.1+.Cruise control transitively pulls vulnerable jackson version via
Apache Kafka
3.1.0. Apache Kafka3.1.1has the fix (see KAFKA-13775),but it is not yet released. We can remove this pin and bump into
3.1.1to resolve this after Kafka
3.1.1is released.