Skip to content

Commit b10abb8

Browse files
Dwayne BaileyDwayne Bailey
Dwayne Bailey
authored and
Dwayne Bailey
committed
Suppress jackson-databind CVE-2018-1000873, won't fix in 2.8.x series
Upstream is not fixing this issue in 2.8.x we need to upgrade to at least >= 2.9.8. Ref FasterXML/jackson-modules-java8#90 (comment) RDM-3796
1 parent e307cdd commit b10abb8

File tree

1 file changed

+5
-2
lines changed

1 file changed

+5
-2
lines changed

dependency-check-suppressions.xml

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -124,8 +124,11 @@
124124
<cve>CVE-2018-19362</cve>
125125
</suppress>
126126
<suppress>
127-
<notes>Temporarily suppress jackson-databind CVE see RDM-3796</notes>
128-
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:.*$</gav>
127+
<notes>jackson-databind 2.8.x will not get a fix for this CVE. We need
128+
to upgrade to 2.9.x. See
129+
https://github.com/FasterXML/jackson-modules-java8/issues/90#issuecomment-450544881
130+
and RDM-3796</notes>
131+
<gav regex="true">^com\.fasterxml\.jackson\.core:jackson-databind:2\.8\.11\.[3].*$</gav>
129132
<cve>CVE-2018-1000873</cve>
130133
</suppress>
131134
<suppress>

0 commit comments

Comments
 (0)