Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: security upgrade jackson-databind from 2.13.0 to 2.13.2 #726

Merged
merged 1 commit into from
Mar 28, 2022
Merged

chore: security upgrade jackson-databind from 2.13.0 to 2.13.2 #726

merged 1 commit into from
Mar 28, 2022

Conversation

tomoyaY
Copy link
Contributor

@tomoyaY tomoyaY commented Mar 26, 2022

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    pom.xml

ref

jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

https://nvd.nist.gov/vuln/detail/CVE-2020-36518

@tomoyaY tomoyaY changed the title security upgrade com.fasterxml.jackson.core:jackson-databind from 2.1… security upgradejackson-databind from 2.3.0 to 2.3.2 Mar 26, 2022
@tomoyaY tomoyaY changed the title security upgradejackson-databind from 2.3.0 to 2.3.2 security upgradejackson-databind from 2.13.0 to 2.13.2 Mar 26, 2022
@tomoyaY tomoyaY changed the title security upgradejackson-databind from 2.13.0 to 2.13.2 chore: security upgradejackson-databind from 2.3.0 to 2.3.2 Mar 26, 2022
@tomoyaY tomoyaY changed the title chore: security upgradejackson-databind from 2.3.0 to 2.3.2 chore: security upgrade jackson-databind from 2.3.0 to 2.3.2 Mar 26, 2022
@childish-sambino childish-sambino changed the title chore: security upgrade jackson-databind from 2.3.0 to 2.3.2 chore: security upgrade jackson-databind from 2.13.0 to 2.13.2 Mar 28, 2022
childish-sambino
childish-sambino approved these changes Mar 28, 2022
View reviewed changes
Copy link
Contributor

@childish-sambino childish-sambino left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Thanks for the fix!

@childish-sambino childish-sambino merged commit f370ca9 into sendgrid:main Mar 28, 2022
@tomoyaY tomoyaY deleted the patch-2 branch March 30, 2022 16:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@childish-sambino childish-sambino childish-sambino approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@tomoyaY @childish-sambino