Repository navigation
Conversation
vharseko
added
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps two BOM-managed dependencies in the
parentPOM to their latest patch releases, so every downstream consumer of the BOM picks up the fixes without per-project overrides.Jackson 2.18.9 → 2.18.11 (
jackson.version)Fixed in 2.18.10:
jackson-databind, high): unbounded number parse inDuration/XMLGregorianCalendardeserialization (DoS).jackson-databind, medium):Comparablemissing fromDefaultBaseTypeLimitingValidator's unsafe base types.jackson-databind, medium):Pathdeserialization has no scheme allowlist forFileSystemProviderresolution.Fixed in 2.18.11:
jackson-databind, high): every unknown raw type ID is retained.jackson-databind, high): quadratic forward-reference completion.jackson-core, high):UTF8DataInputJsonParser._reportInvalidToken()ignoresmaxErrorTokenLength(unboundedStringBuildergrowth).jackson-core, high): ReDoS through quadratic backtracking inNumberInput.PATTERN_FLOAT.Netty 4.2.15.Final → 4.2.18.Final (
netty-bom)Fixed in 4.2.17.Final:
netty-handler, critical): a fragmented TLS ClientHello bypasses SNI routing and falls back to the defaultSslContext.netty-handler, medium): quadratic pre-handshake reassembly of fragmented ClientHello records.netty-codec-http, medium): CORSVaryheader overwrite (cache poisoning).Fixed in 4.2.16.Final:
netty-codec-http, high): SPDY SETTINGS frame count materializes an unbounded settings map.netty-codec-http, high): SPDY zlib header block keeps expanding aftermaxHeaderSizetruncation.netty-codec-http, high):SpdyHttpDecoderleaks aByteBufon RST_STREAM.netty-codec-http2, high): HTTP/2 decompression leaks aByteBufwhen the decompressor channel is already closed.netty-codec-compression, high): infinite loop in theBzip2DecoderRLE state machine.netty-codec-http, medium): CORS short-circuit failure bypasses the security control.netty-codec-http, medium): WebSocket V07/V08 handshaker skipsConnection/Upgradevalidation.netty-codec-http, medium): unbounded per-connection queue inHttpContentEncoderwith HTTP/1.1 pipelining.netty-codec-http2, medium): noHostheader deduplication in HTTP/2 → HTTP/1.x translation.netty-codec-http, medium): CRLF injection through the multipart filename inHttpPostRequestEncoder.The GitHub Advisory Database reports no known advisories against Jackson 2.18.11 or Netty 4.2.18.Final.
Verification
dependency:list:jackson-core,jackson-databindandjackson-annotationsresolve to 2.18.11, and allio.nettymodules resolve to 4.2.18.Final.commons/util/util(451),commons/json-web-token(328),commons/json-crypto/core(7).cassandra-embedded(the Netty consumer)EmbeddedServerTestpasses on JDK 17. The module skips its tests on JDK 18+.