Purushottam Sinha created FLINK-40341:
-----------------------------------------
Summary: flink-kubernetes-operator: Bump jackson-bom to 2.21.5 to
retire 11 advisories
Key: FLINK-40341
URL: https://issues.apache.org/jira/browse/FLINK-40341
Project: Flink
Issue Type: Bug
Components: Kubernetes Operator
Reporter: Purushottam Sinha
Problem
jackson-bom is pinned at 2.21.3, which is affected by 11 published advisories —
10 against jackson-databind and 1 against jackson-core. Three are rated HIGH.
Both artifacts are bundled in the operator's shaded JAR.
Evidence
- pom.xml:126 pins com.fasterxml.jackson:jackson-bom at 2.21.3.
- flink-kubernetes-operator/src/main/resources/META-INF/NOTICE lists
jackson-databind, jackson-core and jackson-annotations 2.21.3 as bundled.
- HIGH advisories: GHSA-j3rv-43j4-c7qm (PolymorphicTypeValidator bypass via
generic type parameters), GHSA-rmj7-2vxq-3g9f (array subtype allowlist bypass
in BasicPolymorphicTypeValidator), GHSA-r7wm-3cxj-wff9 (maxNumberLength bypass
in the async parser).
Proposed fix
- Bump jackson-bom to 2.21.5, the lowest version clearing all 11 (several
require 2.21.5 rather than 2.21.4).
- Refresh the jackson versions in the affected META-INF/NOTICE files.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
