From cdf493859cdb82ca0f4c3418c12bd68bf8c1bc9e Mon Sep 17 00:00:00 2001 From: "Joseph (Ting-Chou) Lin" Date: Thu, 31 Mar 2022 10:32:48 -0700 Subject: [PATCH] Bump vulnerable transitive jackson-databind dependency There's a vulnerability in jackson-databind CVE-2020-36518, which gets resolved in jackson-databind 2.12.6.1+/2.13.1+. Cruise control transitively pulls vulnerable jackson version via Apache Kafka 3.1.0. Apache Kafka 3.1.1 has the fix (See KAFKA-13775), but it is not yet released. We can remove this pin and bump into 3.1.1 to resolve this after Kafka 3.1.1 is released. --- build.gradle | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/build.gradle b/build.gradle index f5d22329dd..373b2d3439 100644 --- a/build.gradle +++ b/build.gradle @@ -255,6 +255,13 @@ project(':cruise-control') { exclude group: 'org.slf4j', module: 'slf4j-log4j12' exclude group: 'log4j', module: 'log4j' } + + constraints { + implementation('com.fasterxml.jackson.core:jackson-databind:2.12.6.1') { + because 'Prior version is vulnerable. Can be unpinned after Apache Kafka 3.1.1 is released and pulled in.' + } + } + api project(':cruise-control-metrics-reporter') api project(':cruise-control-core') implementation "org.slf4j:slf4j-api:1.7.36" @@ -396,6 +403,13 @@ project(':cruise-control-metrics-reporter') { exclude group: 'org.slf4j', module: 'slf4j-log4j12' exclude group: 'log4j', module: 'log4j' } + + constraints { + implementation('com.fasterxml.jackson.core:jackson-databind:2.12.6.1') { + because 'Prior version is vulnerable. Can be unpinned after Apache Kafka 3.1.1 is released and pulled in.' + } + } + implementation "org.slf4j:slf4j-api:1.7.36" implementation "com.yammer.metrics:metrics-core:2.2.0" implementation "org.apache.logging.log4j:log4j-slf4j-impl:2.17.2"