[qZZ3O2uX] Updates jackson-databind to fix CVE-2020-36518, CVE-2022-42004, CVE-2022-42003 #3409
Conversation
gem-neo4j
added
dependencies
gem-neo4j
force-pushed
the
4.4_update_jackson_bind_dependencies
branch
from
4f61166
to
cf604ac
Compare
| @@ -118,8 +118,8 @@ dependencies { | |||
| testCompile 'org.mock-server:mockserver-netty:5.13.0' | |||
| testCompile 'org.mock-server:mockserver-client-java:5.13.0' | |||
|
|
|||
| compileOnly group: 'com.amazonaws', name: 'aws-java-sdk-comprehend', version: '1.12.214' , withoutJacksons | |||
| testImplementation group: 'com.amazonaws', name: 'aws-java-sdk-comprehend', version: '1.12.214' , withoutJacksons | |||
| compileOnly group: 'com.amazonaws', name: 'aws-java-sdk-comprehend', version: '1.12.353' , withoutJacksons | |||
There was a problem hiding this comment.
According to the changelog https://github.com/aws/aws-sdk-java/blob/master/CHANGELOG.md I think this was fixed in 1.12.322, but SNYK suggest to update to the latest version, which as of yesterday is 1.12.388. Any particular reason why you upgraded to specifically 1.12.353? I think in general the newest stable version which has the fix in it and work with our other dependencies would be good
There was a problem hiding this comment.
Because the absolute latest version will introduce a breaking change for us. In AWS Entity (https://github.com/aws/aws-sdk-java/blob/master/aws-java-sdk-comprehend/src/main/java/com/amazonaws/services/comprehend/model/Entity.java#L79) a new field was introduced. APOC returns this whole structure in some of the procedures, which means a new field would be added, it didn't feel worth it to update for this tbh especially as it is in extended. So the bump fixes the databind issues, and doesn't introduce new behaviour :)
* [qZZ3O2uX] Updates jackson-databind to fix CVE-2020-36518, CVE-2022-42004, CVE-2022-42003 (#3409) * [H10zCpAQ] Fix CWE-73: Added check to prevent reading from outside metrics directory (#3245)
vuln-fix: Update dependencies which import jackson-databind that had the following vulnerabilities: CVE-2020-36518, CVE-2022-42004, CVE-2022-42003.