Merge pull request #398 from deki/CVE-2020-25649

Dennis Kieselhorst · web-flow · commit 84a51977a899 · 2021-07-21T17:41:04.000+02:00
Upgrade Jackson version to 2.12.0 (CVE-2020-25649)
diff --git a/aws-serverless-jersey-archetype/src/main/resources/archetype-resources/pom.xml b/aws-serverless-jersey-archetype/src/main/resources/archetype-resources/pom.xml
@@ -15,7 +15,7 @@
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
         <jersey.version>2.30.1</jersey.version>
-        <jackson.version>2.10.3</jackson.version>
+        <jackson.version>2.12.0</jackson.version>
     </properties>
 
     <dependencies>
diff --git a/aws-serverless-spark-archetype/src/main/resources/archetype-resources/build.gradle b/aws-serverless-spark-archetype/src/main/resources/archetype-resources/build.gradle
@@ -9,7 +9,7 @@ dependencies {
   compile (
           'com.sparkjava:spark-core:2.9.1',
           'com.amazonaws.serverless:aws-serverless-java-container-spark:[1.0,)',
-          'com.fasterxml.jackson.core:jackson-databind:2.10.3',
+          'com.fasterxml.jackson.core:jackson-databind:2.12.0',
           'io.symphonia:lambda-logging:1.0.1'
   )
 
diff --git a/aws-serverless-spark-archetype/src/main/resources/archetype-resources/pom.xml b/aws-serverless-spark-archetype/src/main/resources/archetype-resources/pom.xml
@@ -16,7 +16,7 @@
     <properties>
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
-        <jackson.version>2.10.3</jackson.version>
+        <jackson.version>2.12.0</jackson.version>
         <spark.version>2.9.1</spark.version>
     </properties>
 
diff --git a/aws-serverless-spring-archetype/src/main/resources/archetype-resources/build.gradle b/aws-serverless-spring-archetype/src/main/resources/archetype-resources/build.gradle
@@ -13,7 +13,7 @@ dependencies {
           'org.apache.logging.log4j:log4j-core:2.8.2',
           'org.apache.logging.log4j:log4j-api:2.8.2',
           'org.apache.logging.log4j:log4j-slf4j-impl:2.8.2',
-          'com.fasterxml.jackson.core:jackson-databind:2.10.3',
+          'com.fasterxml.jackson.core:jackson-databind:2.12.0',
           'com.amazonaws:aws-lambda-java-log4j2:1.1.0',
   )
 
diff --git a/aws-serverless-struts2-archetype/src/main/resources/archetype-resources/build.gradle b/aws-serverless-struts2-archetype/src/main/resources/archetype-resources/build.gradle
@@ -27,7 +27,7 @@ dependencies {
     exclude group: 'org.apache.logging.log4j', module: 'log4j-api'
   }
   compile ('org.hibernate:hibernate-validator:4.3.2.Final')
-  compile ('com.fasterxml.jackson.core:jackson-databind:2.10.3')
+  compile ('com.fasterxml.jackson.core:jackson-databind:2.12.0')
   compile ('org.apache.logging.log4j:log4j-core:2.8.2')
   compile ('org.apache.logging.log4j:log4j-api:2.8.2')
   compile ('org.apache.logging.log4j:log4j-slf4j-impl:2.8.2')
diff --git a/aws-serverless-struts2-archetype/src/main/resources/archetype-resources/pom.xml b/aws-serverless-struts2-archetype/src/main/resources/archetype-resources/pom.xml
@@ -16,7 +16,7 @@
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
         <struts2.version>2.5.22</struts2.version>
-        <jackson.version>2.10.3</jackson.version>
+        <jackson.version>2.12.0</jackson.version>
         <junit.version>4.12</junit.version>
         <log4j.version>2.8.2</log4j.version>
     </properties>
diff --git a/pom.xml b/pom.xml
@@ -84,7 +84,7 @@
     <properties>
         <jacoco.minCoverage>0.7</jacoco.minCoverage>
         <dependencyCheck.version>5.3.2</dependencyCheck.version>
-        <jackson.version>2.10.3</jackson.version>
+        <jackson.version>2.12.0</jackson.version>
         <slf4j.version>1.7.30</slf4j.version>
     </properties>
 
diff --git a/samples/jersey/pet-store/build.gradle b/samples/jersey/pet-store/build.gradle
@@ -9,7 +9,7 @@ dependencies {
   compile (
           'com.amazonaws:aws-lambda-java-core:1.2.0',
           'com.amazonaws.serverless:aws-serverless-java-container-jersey:[1.0,)',
-          'com.fasterxml.jackson.core:jackson-databind:2.10.3',
+          'com.fasterxml.jackson.core:jackson-databind:2.12.0',
           'io.symphonia:lambda-logging:1.0.1'
   )
 
diff --git a/samples/jersey/pet-store/pom.xml b/samples/jersey/pet-store/pom.xml
@@ -27,7 +27,7 @@
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
         <jersey.version>2.30.1</jersey.version>
-        <jackson.version>2.10.3</jackson.version>
+        <jackson.version>2.12.0</jackson.version>
     </properties>
 
     <dependencies>
diff --git a/samples/spark/pet-store/build.gradle b/samples/spark/pet-store/build.gradle
@@ -9,7 +9,7 @@ dependencies {
   compile (
           'com.sparkjava:spark-core:2.9.1',
           'com.amazonaws.serverless:aws-serverless-java-container-spark:[1.0,)',
-          'com.fasterxml.jackson.core:jackson-databind:2.10.3',
+          'com.fasterxml.jackson.core:jackson-databind:2.12.0',
           'io.symphonia:lambda-logging:1.0.1'
   )
 }
diff --git a/samples/spark/pet-store/pom.xml b/samples/spark/pet-store/pom.xml
@@ -26,7 +26,7 @@
     <properties>
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
-        <jackson.version>2.10.3</jackson.version>
+        <jackson.version>2.12.0</jackson.version>
         <spark.version>2.9.1</spark.version>
     </properties>
 
diff --git a/samples/spring/pet-store/build.gradle b/samples/spring/pet-store/build.gradle
@@ -13,7 +13,7 @@ dependencies {
           'org.apache.logging.log4j:log4j-core:2.8.2',
           'org.apache.logging.log4j:log4j-api:2.8.2',
           'org.apache.logging.log4j:log4j-slf4j-impl:2.8.2',
-          'com.fasterxml.jackson.core:jackson-databind:2.10.3',
+          'com.fasterxml.jackson.core:jackson-databind:2.12.0',
           'com.amazonaws:aws-lambda-java-log4j2:1.1.0',
   )
 }
diff --git a/samples/struts2/pet-store/build.gradle b/samples/struts2/pet-store/build.gradle
@@ -14,7 +14,7 @@ dependencies {
           'org.apache.struts:struts2-junit-plugin:2.5.22',
           'com.jgeppert.struts2:struts2-aws-lambda-support-plugin:1.1.0',
           'org.hibernate:hibernate-validator:4.3.2.Final',
-          'com.fasterxml.jackson.core:jackson-databind:2.10.3',
+          'com.fasterxml.jackson.core:jackson-databind:2.12.0',
           'org.apache.logging.log4j:log4j-core:2.8.2',
           'org.apache.logging.log4j:log4j-api:2.8.2',
           'org.apache.logging.log4j:log4j-slf4j-impl:2.8.2',
diff --git a/samples/struts2/pet-store/pom.xml b/samples/struts2/pet-store/pom.xml
@@ -27,7 +27,7 @@
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
         <struts2.version>2.5.22</struts2.version>
-        <jackson.version>2.10.3</jackson.version>
+        <jackson.version>2.12.0</jackson.version>
         <junit.version>4.13.1</junit.version>
         <log4j.version>2.13.3</log4j.version>
     </properties>

Original file line number	Diff line number	Diff line change
`@@ -9,7 +9,7 @@ dependencies {`
`9`	`9`	`compile (`
`10`	`10`	`'com.sparkjava:spark-core:2.9.1',`
`11`	`11`	`'com.amazonaws.serverless:aws-serverless-java-container-spark:[1.0,)',`
`12`		`- 'com.fasterxml.jackson.core:jackson-databind:2.10.3',`
	`12`	`+ 'com.fasterxml.jackson.core:jackson-databind:2.12.0',`
`13`	`13`	`'io.symphonia:lambda-logging:1.0.1'`
`14`	`14`	`)`
`15`	`15`
Original file line number	Diff line number	Diff line change
`@@ -13,7 +13,7 @@ dependencies {`
`13`	`13`	`'org.apache.logging.log4j:log4j-core:2.8.2',`
`14`	`14`	`'org.apache.logging.log4j:log4j-api:2.8.2',`
`15`	`15`	`'org.apache.logging.log4j:log4j-slf4j-impl:2.8.2',`
`16`		`- 'com.fasterxml.jackson.core:jackson-databind:2.10.3',`
	`16`	`+ 'com.fasterxml.jackson.core:jackson-databind:2.12.0',`
`17`	`17`	`'com.amazonaws:aws-lambda-java-log4j2:1.1.0',`
`18`	`18`	`)`
`19`	`19`
Original file line number	Diff line number	Diff line change
`@@ -27,7 +27,7 @@ dependencies {`
`27`	`27`	`exclude group: 'org.apache.logging.log4j', module: 'log4j-api'`
`28`	`28`	`}`
`29`	`29`	`compile ('org.hibernate:hibernate-validator:4.3.2.Final')`
`30`		`- compile ('com.fasterxml.jackson.core:jackson-databind:2.10.3')`
	`30`	`+ compile ('com.fasterxml.jackson.core:jackson-databind:2.12.0')`
`31`	`31`	`compile ('org.apache.logging.log4j:log4j-core:2.8.2')`
`32`	`32`	`compile ('org.apache.logging.log4j:log4j-api:2.8.2')`
`33`	`33`	`compile ('org.apache.logging.log4j:log4j-slf4j-impl:2.8.2')`