auth0 / java-jwt

Java implementation of JSON Web Token (JWT)

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Update dependency to jackson library due to CVE-2022-42003 and CVE-2022-42004

uap-universe opened this issue · comments

Please update the dependency

com.fasterxml.jackson.core:jackson-databind:2.13.2.2

to

com.fasterxml.jackson.core:jackson-databind:2.14

as soon as it becomes available

(see also: related issue and milestone)

2.13.4.1 is available with a fix for CVE-2022-42003
see https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.13

(and 2.13.4.2 is available also)

Thanks @brackxm. We have made #631 and #630 to bump the versions. We will get patch releases out shortly.

4.2.1 and 3.19.3 have been released and are available in Maven Central 👍