ibm-cos-java-sdk-bundle 2.11.1 contains vulnerable jackson-databind 2.13.1

[klajok]

The library jackson-databind version 2.13.1 is embedded in the latest version 2.11.1 of ibm-cos-java-sdk-bundle .

According to GHSA-57j2-w4cx-62h2 the above version of Jackson Databind is vulnerable.

Please prepare new release of COS Java SDK bundle with updated Jackson Databind library.

[IBMeric]

Thanks for your report. We have an internal ticket to complete this work.

[hbornstein747]

Do you have an ETA when the new version will be available?

[hbornstein747]

Latest CVE requires update to 2.13.2.2. Hopefully this will be included. (I am with the the CP4D dev team)

[avinash1IBM]

Thank for the update. This change will be included in the next release. Thanks

[hbornstein747]

Thanks Avinash - can you tell me when that is?

[avinash1IBM]

Hello,
The next release will be in second quarter.
Thanks.

[IBMeric]

@klajok @hbornstein747 We have released 2.11.2 to address this issue. Please verify and close this ticket.

[hbornstein747]

Thank you. I can verify the issue is resolved.

[klajok]

Thank you.