CVE-2022-42003 - ibm-cos-java-sdk-bundle 2.12.0 contains vulnerable in jackson-databind 2.13.3

[mkrakow]

The library jackson-databind version 2.13.3 is embedded in the latest version 2.12.0 of ibm-cos-java-sdk-bundle .

According to GHSA-57j2-w4cx-62h2 the above version of Jackson Databind is vulnerable.

Could you please fix COS Java SDK bundle with updated Jackson Databind library to 2.14.0 ?

[IBMalok]

@mkrakow - Thanks for your report. We have an internal ticket to complete this work.

[tcherel]

@IBMalok do you have an idea when that will be completed?
Jackson Databind library to 2.14.0 is not GA yet but 2.13.4.2 (already GA) contains all the fixes need for this vulnerability (as well as some of the recent new ones (https://nvd.nist.gov/vuln/detail/CVE-2022-42003 and https://nvd.nist.gov/vuln/detail/CVE-2022-42004).

[IBMalok]

@tcherel - We're going to release soon.

[IBMalok]

@mkrakow @tcherel - We have released 2.12.1 to address this issue. Please verify and close this ticket.

[IBMalok]

Closing this issue as resolved.

[tcherel]

@IBMalok my apologies, forgot to update the git issue to confirm that the issue is indeed fixed.
Thanks