[
https://issues.apache.org/jira/browse/FLINK-40071?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Purushottam Sinha updated FLINK-40071:
--------------------------------------
Description:
jackson-databind 2.21.3 is affected by several recently published CVEs
(CVE-2026-54512 through 54518).
flink-shaded 22.0 now bundles jackson 2.22.2, so bump the non-shaded
jackson-bom.version 2.21.3 -> 2.22.2 to keep the two in sync. 2.22.2 is a
superset of the 2.21.5 fixes and clears all seven CVEs. Update the NOTICE
files of the modules bundling jackson.
was:
Description:
jackson-databind 2.21.3 is affected by several recently published CVEs
(CVE-2026-54512 through 54518). 2.21.5 fixes all of them.
Bump jackson-bom.version 2.21.3 -> 2.21.5 and update the NOTICE files of
modules bundling jackson.
Fixed by 2.21.5:
- CVE-2026-54512 (High)
- CVE-2026-54513 (High)
- CVE-2026-54514 (Medium)
- CVE-2026-54515 (Medium)
- CVE-2026-54516 (Medium)
- CVE-2026-54517 (Medium)
- CVE-2026-54518 (Medium)
> Bump jackson-bom to 2.22.2
> --------------------------
>
> Key: FLINK-40071
> URL: https://issues.apache.org/jira/browse/FLINK-40071
> Project: Flink
> Issue Type: Technical Debt
> Components: Build System
> Reporter: Purushottam Sinha
> Priority: Minor
> Labels: pull-request-available
>
> jackson-databind 2.21.3 is affected by several recently published CVEs
> (CVE-2026-54512 through 54518).
> flink-shaded 22.0 now bundles jackson 2.22.2, so bump the non-shaded
> jackson-bom.version 2.21.3 -> 2.22.2 to keep the two in sync. 2.22.2 is a
> superset of the 2.21.5 fixes and clears all seven CVEs. Update the NOTICE
> files of the modules bundling jackson.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
