Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade version of jackson_databind as per twistlock scan #315

Open
shivangi24 opened this issue Nov 10, 2022 · 1 comment
Open

Upgrade version of jackson_databind as per twistlock scan #315

shivangi24 opened this issue Nov 10, 2022 · 1 comment

Comments

@shivangi24
Copy link
Contributor

shivangi24 commented Nov 10, 2022

Twistlock issue is reported to upgrade jackson-databind of stocator jar

CVE-2022-42003 | high  | jackson-databind | 2.13.3 | 2.13.4.1 | /opt/ibm/connectors/stocator/stocator-1.1.5-IBM-SDK.jar | In FasterXML jackson-databind before   2.14.0-rc1, resource  exhaustion can occur because of a lack of a check in   primitive value  deserializers to avoid deep wrapper array nesting, when the    UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled. Additional fix version in    2.13.4.1 and 2.12.17.1 | Upgrade package jackson-databind to version   2.13.4.1 or above.

CVE-2022-42004 | high  | jackson-databind | 2.13.3 | 2.13.4 | /opt/ibm/connectors/stocator/stocator-1.1.5-IBM-SDK.jar | In FasterXML jackson-databind before 2.13.4, resource exhaustion can    occur because of a lack of a check in  BeanDeserializer._deserializeFromArray   to prevent use of deeply nested  arrays. An application is vulnerable only   with certain customized  choices for deserialization. | Upgrade package jackson-databind to version 2.13.4 or above.
@shivangi24
Copy link
Contributor Author

PR for update : #314

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant