[
https://issues.apache.org/jira/browse/OOZIE-3650?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17474479#comment-17474479
]
PJ Fanning edited comment on OOZIE-3650 at 1/12/22, 12:26 PM:
--------------------------------------------------------------
Latest version of Spark uses jackson 2.12.3 -
[https://mvnrepository.com/artifact/org.apache.spark/spark-core_2.13/3.2.0]
[~asalamon74] if you're comfortable that oozie is not vulnerable to any of the
jackson deserialization vulnerablities (including Remote Code Execution
possibilities) - then feel free to ignore this issue.
was (Author: pj.fanning):
Latest version of Spark uses jackson 2.12.3 -
[https://mvnrepository.com/artifact/org.apache.spark/spark-core_2.13/3.2.0]
[~asalamon74] if you're comfortable that oozie is not vulnerable to any of the
jackson deserialization vulnerablities - then feel free to ignore this issue.
> upgrade jackson - ideally to v2.13.1
> ------------------------------------
>
> Key: OOZIE-3650
> URL: https://issues.apache.org/jira/browse/OOZIE-3650
> Project: Oozie
> Issue Type: Improvement
> Reporter: PJ Fanning
> Priority: Major
>
> Oozie currently has a dependency on an old version of Jackson (2.6.5) -
> [https://github.com/apache/oozie/blob/master/pom.xml#L119]
> There are a number of CVEs open affecting this version.
> https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-databind/2.6.5
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
