Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

updating jackson-core version #1237

Open
wants to merge 2 commits into
base: branch-2.2.x
Choose a base branch
from

Conversation

ShyamalaGowri
Copy link

shaded jar https://repo1.maven.org/maven2/com/google/cloud/bigdataoss/gcs-connector/hadoop3-2.2.25/gcs-connector-hadoop3-2.2.25-shaded.jar contains CVE PRISMA-2023-0067. (https://nvd.nist.gov/vuln/detail/CVE-2023-0067)
This is because it includes jackson-core (This is required by google-api-client-jackson2)

<groupId>com.fasterxml.jackson.core</groupId>
  <artifactId>jackson-core</artifactId>
  <name>Jackson-core</name>
  <version>2.13.4</version>

I have fixed the CVE by excluding the version that had the vulnerability and added the fix by adding

<groupId>com.fasterxml.jackson.core</groupId>
 <artifactId>jackson-core</artifactId>
 <version>2.15.0</version>

This PR contains the fix for the issue #1221

Copy link

google-cla bot commented Aug 3, 2024

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@ShyamalaGowri
Copy link
Author

/gcbrun

@ShyamalaGowri
Copy link
Author

ShyamalaGowri commented Aug 3, 2024

@arunkumarchacko i am trying to fix the vulnerability issue caused by the jackson-core package. Requesting you to trigger dataproc-hadoop-connectors-presubmit-pr (cloud-dataproc-ci)

@ShyamalaGowri
Copy link
Author

@arunkumarchacko @singhravidutt Please take a look at this PR where i have tried to address a vulnerability issue PRISMA-2023-0067

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant