Skip to content

Remove explict dependency on jackson-databind#1709

Merged
peternied merged 2 commits intoopensearch-project:mainfrom
peternied:no-databind
Mar 31, 2022
Merged

Remove explict dependency on jackson-databind#1709
peternied merged 2 commits intoopensearch-project:mainfrom
peternied:no-databind

Conversation

@peternied
Copy link
Member

@peternied peternied commented Mar 24, 2022

Description

Attempted workaround for a jar hell conflict in OpenSearch 2.0.0, confirming that tests can still run and pass as expected

Issues Resolved

Testing

By running in the installation workflow, we can see if the security plugin load or create other unexpected issues.

Check List

  • New functionality includes testing
  • New functionality has been documented
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

@peternied peternied force-pushed the no-databind branch 2 times, most recently from 8ed1389 to f018027 Compare March 25, 2022 15:56
Signed-off-by: Peter Nied <petern@amazon.com>
@peternied peternied marked this pull request as ready for review March 31, 2022 16:03
@peternied peternied requested a review from a team March 31, 2022 16:03
@peternied
Copy link
Member Author

@opensearch-project/security Could I get another review please, this is blocking 2.0.0

@peternied peternied merged commit 409ba02 into opensearch-project:main Mar 31, 2022
@peternied peternied deleted the no-databind branch March 31, 2022 17:00
@cliu123 cliu123 mentioned this pull request Apr 21, 2022
3 tasks
wuychn pushed a commit to ochprince/security that referenced this pull request Mar 16, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] Plugin installation on OpenSearch 2.0.0 runs into jar hell CVE-2020-36518 (High) detected in jackson-databind-2.13.2.jar - autoclosed

3 participants