raboof/pekko
1
0
Fork 0
Code Issues Pull requests Projects Releases 6 Packages Wiki Activity Actions 10

Update to Jackson databind 2.9.9.1 to fix CVE-2019-12384 and CVE-2019-12814

Browse source 
* Block  gadget type for CVE-2019-12384
* Block gadget type CVE-2019-12814
* new classes blocked in SubTypeValidator.DEFAULT_NO_DESER_CLASS_NAMES,
  which we use from Akka so updating the dependency is enough
This commit is contained in:
Patrik Nordwall 2019-07-11 13:51:05 +02:00
parent a4f090b622
commit 86efe39afd
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
project/Dependencies.scala
View file

@ -23,6 +23,7 @@ object Dependencies {
val agronaVersion = "1.0.1"
val nettyVersion = "3.10.6.Final"
val jacksonVersion = "2.9.9"
val jacksonDatabindVersion = "2.9.9.1"
val scala212Version = "2.12.8"
val scala213Version = "2.13.0"
@ -87,7 +88,7 @@ object Dependencies {
val jacksonCore = "com.fasterxml.jackson.core" % "jackson-core" % jacksonVersion // ApacheV2
val jacksonAnnotations = "com.fasterxml.jackson.core" % "jackson-annotations" % jacksonVersion // ApacheV2
val jacksonDatabind = "com.fasterxml.jackson.core" % "jackson-databind" % jacksonVersion // ApacheV2
val jacksonDatabind = "com.fasterxml.jackson.core" % "jackson-databind" % jacksonDatabindVersion // ApacheV2
val jacksonJdk8 = "com.fasterxml.jackson.datatype" % "jackson-datatype-jdk8" % jacksonVersion // ApacheV2
val jacksonJsr310 = "com.fasterxml.jackson.datatype" % "jackson-datatype-jsr310" % jacksonVersion // ApacheV2
val jacksonScala = "com.fasterxml.jackson.module" %% "jackson-module-scala" % jacksonVersion // ApacheV2