[
https://issues.apache.org/jira/browse/FLINK-40341?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
ASF GitHub Bot updated FLINK-40341:
-----------------------------------
Labels: pull-request-available (was: )
> flink-kubernetes-operator: Bump jackson-bom to 2.21.5 to retire 11 advisories
> -----------------------------------------------------------------------------
>
> Key: FLINK-40341
> URL: https://issues.apache.org/jira/browse/FLINK-40341
> Project: Flink
> Issue Type: Bug
> Components: Kubernetes Operator
> Reporter: Purushottam Sinha
> Priority: Minor
> Labels: pull-request-available
>
> Problem
> jackson-bom is pinned at 2.21.3, which is affected by 11 published advisories
> — 10 against jackson-databind and 1 against jackson-core. Three are rated
> HIGH. Both artifacts are bundled in the operator's shaded JAR.
> Evidence
> - pom.xml:126 pins com.fasterxml.jackson:jackson-bom at 2.21.3.
> - flink-kubernetes-operator/src/main/resources/META-INF/NOTICE lists
> jackson-databind, jackson-core and jackson-annotations 2.21.3 as bundled.
> - HIGH advisories: GHSA-j3rv-43j4-c7qm (PolymorphicTypeValidator bypass via
> generic type parameters), GHSA-rmj7-2vxq-3g9f (array subtype allowlist bypass
> in BasicPolymorphicTypeValidator), GHSA-r7wm-3cxj-wff9 (maxNumberLength
> bypass in the async parser).
> Proposed fix
> - Bump jackson-bom to 2.21.5, the lowest version clearing all 11 (several
> require 2.21.5 rather than 2.21.4).
> - Refresh the jackson versions in the affected META-INF/NOTICE files.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
